BridgerAlderson/CVE-2025-69212-PoC

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2025-69212, an OS command injection vulnerability in OpenSTAManager <= 2.9.8. The script authenticates to the target, discovers the vulnerable plugin, and uploads a crafted ZIP file containing a .p7m file with a malicious filename to achieve remote code execution. It supports vulnerability checking, webshell deployment, interactive shell, reverse shell, and blind command execution.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit script and a README for CVE-2025-69212, an OS command injection vulnerability in OpenSTAManager. The exploit automates authenticated exploitation of the described vulnerability (check, webshell deployment, reverse shell, blind command execution, interactive shell). All code behavior is consistent with the stated purpose of demonstrating and exploiting the CVE. No concealed, deceptive, or unrelated harmful behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareOpenSTAManager
Attack typesOS command injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2025-69212 to achieve remote code execution. It crafts and uploads a malicious payload to trigger the vulnerability, and includes multiple post-exploitation features such as webshell deployment, reverse shell, and interactive command execution. This goes beyond mere detection or scanning.

exploit.py:1-3exploit.py:276-285exploit.py:347-542README.md:42-55

Requirements

  • Valid credentials (username/password) or a valid PHPSESSID cookie for an OpenSTAManager instance.exploit.py:84-86exploit.py:602-603
  • The target must have the importFE_ZIP plugin installed and accessible.README.md:39-40exploit.py:217-274

Observed behavior

  • Authenticates to the target OpenSTAManager instance using provided credentials or session cookie.exploit.py:114-174
  • Discovers the module and plugin IDs for the importFE_ZIP plugin by scanning the application's pages.exploit.py:217-274
  • Crafts a ZIP archive containing a .p7m file with a malicious filename that injects OS commands via the exec() call in XML::decodeP7M().exploit.py:276-285README.md:185-196
  • Uploads the malicious ZIP file to the discovered plugin endpoint to trigger command execution.exploit.py:288-323
  • Provides multiple exploitation modes: vulnerability check (--check), webshell deployment (--webshell), interactive shell (--rce), reverse shell (--reverse-shell), and blind command execution (--cmd).exploit.py:347-375exploit.py:377-408exploit.py:410-461exploit.py:463-490exploit.py:492-542
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The exploit.py script implements authenticated exploitation of CVE-2025-69212, including vulnerability check, webshell deployment, reverse shell, blind command execution, and interactive shell.All actions are directed at the target specified by the user and are consistent with the documented vulnerability.exploit.py:82-543
Payload Encoding
The exploit encodes commands in base32 to avoid forward slashes in filenames, a known constraint of the vulnerability.This is a documented technique to bypass the ZipArchive filename restriction, not an attempt to conceal malicious behavior.exploit.py:276-278README.md:199-207
Network Communication
The script sends HTTP requests to the target server and optionally to a user-specified proxy.No unexpected external network connections are made; all communication is directed at the target or proxy as configured by the user.exploit.py:98-105
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the text evidence due to being unclassified, but it is not expected to contain exploit logic.
  • The evidence coverage is complete for the two selected text files (README.md and exploit.py), which constitute the entire functional artifact.
  • One unclassified file (1068 bytes) was present in the repository but not analyzed; its content is unknown.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the exploit.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1