Tagoletta/CVE-2025-69458

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2025-69458, an unauthenticated SQL injection vulnerability in Movie Rating System 1.0, to achieve remote code execution by writing a PHP webshell to the target server via INTO OUTFILE.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2025-69458.py) and a README.md file. The Python script is a proof-of-concept exploit for CVE-2025-69458 that automates SQL injection to achieve remote code execution on a target Movie Rating System 1.0 application. The script takes a target URL as input, performs SQL injection to write a PHP webshell, and then executes a 'whoami' command via the webshell to demonstrate control. The README.md contains only two external links to a write-up and an Exploit-DB entry. No backdoor, deceptive payload, or behavior targeting the person running the PoC is observed. The script's actions are consistent with the stated exploit purpose and do not exhibit any concealed operator-directed harm against the user executing the PoC.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareMovie Rating System 1.0
Attack typesSQL InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits a SQL injection vulnerability to write a PHP file to the server and then executes a system command on the target, which is the definition of an exploit.

CVE-2025-69458.py:54-56CVE-2025-69458.py:61

Requirements

  • Target URL of a vulnerable Movie Rating System 1.0 instance.CVE-2025-69458.py:6
  • Target must have a writable web directory and MySQL FILE privilege for the database user.CVE-2025-69458.py:54-56

Observed behavior

  • Prompts user for target URL and normalizes it.CVE-2025-69458.py:6-11
  • Crafts a PHP webshell payload that executes system commands via a GET parameter.CVE-2025-69458.py:13
  • Scrapes the target's homepage to find a link to a 'movie' page, then navigates to it to find a SQL injection point.CVE-2025-69458.py:18-34
  • Triggers a SQL error by appending a single quote to extract the server file path of the vulnerable script.CVE-2025-69458.py:41-42
  • Constructs a SQL injection payload using INTO OUTFILE to write the PHP webshell to the discovered directory.CVE-2025-69458.py:54-56
  • Sends the malicious SQL injection request to upload the webshell.CVE-2025-69458.py:59
  • Executes the 'whoami' command on the target via the uploaded webshell and prints the output and shell URL.CVE-2025-69458.py:61-63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Script automates SQL injection to write a PHP webshell and executes 'whoami' on the target.The script's behavior is consistent with a standard proof-of-concept exploit for CVE-2025-69458. It does not perform any actions against the user running the script.CVE-2025-69458.py:13CVE-2025-69458.py:54-56CVE-2025-69458.py:61
User Input
Script prompts for a target URL via input().The script requires the user to specify the target system. It does not contain any hardcoded or hidden target addresses.CVE-2025-69458.py:6
Payload Generation
PHP webshell payload is generated locally and written to the target via SQL injection.The payload is a simple PHP command execution shell. It is not obfuscated and its purpose is clearly related to the exploit.CVE-2025-69458.py:13
Review boundaries

What the analysis did not establish

  • CVE-2025-69458 record was absent from the acquired CVEList V5 dataset, so CVE details are unverified.
  • The README.md references an external writeup and ExploitDB entry, but their content was not included in the evidence.
  • The review is limited to the supplied text files (CVE-2025-69458.py and README.md). No binary files were present. The analysis does not assess the safety of the external links in README.md or the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1