shinthink/CVE-2025-32044

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based scanner that detects Moodle instances vulnerable to CVE-2025-32044 by checking for the presence of stack traces with sensitive arguments in REST API error responses. It does not exploit the vulnerability to exfiltrate data beyond what is returned in the error response itself.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python PoC for CVE-2025-32044, a Moodle information disclosure vulnerability. The script sends HTTP requests to target Moodle instances to trigger stack trace leaks and parse exposed user data. No backdoor, trojan, or deceptive payload was observed. The code performs only the advertised vulnerability scanning and exploitation behavior.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareMoodle LMS
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary operation of the code is to detect and report the presence of the vulnerability by checking for a specific indicator (stack traces with 'args' in API error responses). It does not perform any action beyond parsing the server's error response, which is characteristic of a scanner. The README describes it as a 'scan' and the code's main class is named 'MassScanner'.

README.md:107-108cve_2025_32044.py:216cve_2025_32044.py:159-176

Requirements

  • Target must be running a vulnerable version of Moodle (4.5.0 - 4.5.2) with web services enabled and PHP's zend.exception_ignore_args set to Off.README.md:15README.md:17README.md:28

Observed behavior

  • Sends HTTP requests to detect Moodle by checking for the string 'moodle' in the response body of /login/index.php.cve_2025_32044.py:108-109
  • Checks if Moodle web services are enabled by requesting /login/token.php with guest credentials.cve_2025_32044.py:131
  • Attempts to obtain a web service token using a list of common credentials.cve_2025_32044.py:145-146
  • Sends malformed requests to REST API endpoints to trigger an exception and then parses the JSON response for a 'stacktrace' key containing 'args'.cve_2025_32044.py:167-172
  • Extracts usernames, emails, and password hashes from the leaked stack trace arguments.cve_2025_32044.py:180-193
  • Outputs a report indicating whether the target is vulnerable and, if so, the number of leaked users, emails, and hashes.cve_2025_32044.py:252-253cve_2025_32044.py:316-323
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Sends HTTP requests to target Moodle instances to detect version, check web services, obtain tokens, and trigger exception leaks.This is the core functionality of the PoC and matches the described CVE-2025-32044 exploitation technique.cve_2025_32044.py:103-176
Credential Attempt
Attempts to obtain Moodle API tokens using a hardcoded list of common credentials (guest/guest, admin/sandbox24, etc.).This is part of the vulnerability assessment to determine if a token can be obtained for authenticated leak testing. It is not a backdoor.cve_2025_32044.py:143-157
Data Extraction
Parses stack trace arguments from API error responses to extract usernames, emails, and password hashes.This is the intended information disclosure described by CVE-2025-32044.cve_2025_32044.py:178-193
Review boundaries

What the analysis did not establish

  • One file (unclassified_bytes: 70) was not provided as text, but its metadata suggests it is a non-essential file (likely a license or .gitignore) and does not affect the classification of the primary Python script and README.
  • One file (unclassified, 70 bytes) was present in the repository but not included as readable text; its content and potential impact are unknown.
  • The review is limited to static analysis of the provided source code; no dynamic execution or network traffic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1