xxconi/CVE-2025-13407

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-13407 in Gravity Forms by uploading a PHP webshell via chunked file upload. It includes a multi-site scanner mode.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that exploits CVE-2025-13407 in Gravity Forms to upload a PHP file. It contains no concealed backdoor, credential theft, persistence mechanism, or unrelated payload. The script performs only the advertised exploit behavior: uploading a PHP webshell or phpinfo file to a vulnerable target.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareGravity Forms WordPress plugin
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP file (webshell) to a vulnerable target, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve code execution.

CVE-2025-13407.py:110-112CVE-2025-13407.py:136-141CVE-2025-13407.py:197-199

Requirements

  • Target must have a page containing a Gravity Forms multifile upload field.CVE-2025-13407.py:120-123
  • The upload path must be discoverable or enumerable.CVE-2025-13407.py:192-195

Observed behavior

  • Sends a chunked file upload request to /?gf_page=upload with a PHP payload disguised as a multi-part upload.CVE-2025-13407.py:144-158
  • Sends a second chunk to finalize the upload, referencing the hash and temp filename from the first chunk.CVE-2025-13407.py:168-184
  • Constructs a URL to the uploaded PHP file under wp-content/uploads/gravity_forms/ and reports it as a webshell.CVE-2025-13407.py:192-199
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Telegram Contact
https://t.me/toolsandpocThe script displays a Telegram group link in the banner and README, which is typical for PoC distribution but does not constitute backdoor behavior.CVE-2025-13407.py:31README.md:3
Output File
pwned.txtThe script writes successful exploit results to a local file, which is expected behavior for a scanning tool and not a backdoor.CVE-2025-13407.py:35
Review boundaries

What the analysis did not establish

  • One non-text media file (107511 bytes) was not analyzed; its content is unknown.
  • The evidence does not confirm whether the exploit code was executed or is functional.
  • One non-text file (likely an image) was present in the repository but not analyzed; its metadata-only inspection showed no executable content.
  • The review is limited to the supplied text evidence and does not verify the script's runtime behavior or the safety of the uploaded PHP payload.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1