Nxploited/CVE-2025-15521

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-15521 in Academy LMS ≤ 3.5.0 by extracting a public nonce from course pages, triggering an unauthenticated password reset for a target user_id, enumerating usernames, and performing strict login verification to confirm account takeover.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2025-15521.py) and a README.md that together implement a proof-of-concept exploit for CVE-2025-15521, an unauthenticated privilege escalation vulnerability in the Academy LMS WordPress plugin. The script automates extraction of a publicly exposed nonce, triggers a password reset for a chosen user ID, enumerates usernames, and attempts strict login verification. All behavior is consistent with the described exploit and does not contain any concealed backdoor, unrelated payload, or deceptive functionality. No obfuscation, persistence mechanisms, credential exfiltration to external parties, or operator-directed harm beyond the stated exploit are present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareAcademy LMS WordPress plugin
Attack typesaccount takeoverprivilege escalationauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by extracting a nonce, triggering a password reset, and verifying account takeover through login and admin access checks. It goes beyond detection or scanning by modifying user credentials and confirming unauthorized access.

CVE-2025-15521.py:314-359CVE-2025-15521.py:514-581README.md:52-61

Requirements

  • Target running Academy LMS ≤ 3.5.0 with course pages exposing academy_nonceREADME.md:25-27
  • Target URL list file with one URL per lineCVE-2025-15521.py:712-715

Observed behavior

  • Extracts academy_nonce from course pages via regex patternsCVE-2025-15521.py:208-240
  • Sends POST request to reset handler with extracted nonce, new password, and user_id to change password without authenticationCVE-2025-15521.py:314-359
  • Enumerates usernames via author ID redirects and REST APICVE-2025-15521.py:375-417
  • Attempts WordPress login with new password and verifies admin access via admin UI markersCVE-2025-15521.py:514-581
  • Writes confirmed account credentials to output fileCVE-2025-15521.py:623-629
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Automated password reset and login verification for CVE-2025-15521The script performs the exact steps described in the README: nonce extraction from course pages, password reset via POST to /academy-retrieve-password/, username enumeration via author archives and REST API, and strict admin access verification. This is consistent with a legitimate PoC for the stated vulnerability.CVE-2025-15521.py:208-240CVE-2025-15521.py:314-359CVE-2025-15521.py:375-417CVE-2025-15521.py:514-581
Output File Writing
Writes verified access entries to a user-specified output fileThe script writes successful login credentials (username and password) to a local file. This is part of the stated functionality to record confirmed access and does not involve exfiltration to a remote server.CVE-2025-15521.py:624-628
Author Contact
Nxploited (Khaled Alenazi), GitHub: https://github.com/Nxploited, Telegram: @KNxploitedAuthor identification is present in the script banner and README. This is standard attribution and does not constitute backdoor behavior.CVE-2025-15521.py:6-8README.md:151-152
Review boundaries

What the analysis did not establish

  • One file (likely .gitignore or similar) omitted from text content; no impact on classification.
  • Evidence not executed; classification based solely on static analysis of provided source code and documentation.
  • One file (unclassified, 1505 bytes) was present in the repository but not included as text; its content is unknown and could not be reviewed.
  • Binary files were flagged as metadata-only and not analyzed; no binary files were reported in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1