CVE-2025-32778 Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Metasploit module that exploits CVE-2025-32778, a command injection vulnerability in the Web-Check screenshot API. It sends a crafted URL parameter containing shell commands to the /api/screenshot endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module source code implements a standard command injection exploit against the Web-Check screenshot API (CVE-2025-32778). It sends a crafted URL parameter containing a shell command to the target, using sleep-based timing for vulnerability detection and delivering a user-supplied payload during exploitation. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit purpose was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareWeb-Check

Attack typescommand injectionremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that includes both a check method for vulnerability detection and an exploit method that delivers a payload to achieve remote code execution.

modules/exploits/multi/http/web_check_screenshot_rce.rb:1-137

Requirements

Target must be running a vulnerable version of Web-Check (< 2.0.1) with the /api/screenshot endpoint exposed.modules/exploits/multi/http/web_check_screenshot_rce.rb:20-23

Observed behavior

The check method sends sleep commands of varying durations and measures response time to confirm command injection.modules/exploits/multi/http/web_check_screenshot_rce.rb:100-131
The exploit method sends the encoded payload as a command injection via the url parameter to the /api/screenshot endpoint.modules/exploits/multi/http/web_check_screenshot_rce.rb:133-136
The build_url method constructs a malicious URL with a command injection payload in a query parameter.modules/exploits/multi/http/web_check_screenshot_rce.rb:84-89

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Vector: URL query parameter injection via 'url' GET parameterThe module constructs a malicious URL with a shell command injected into a query parameter value, which is then sent to the /api/screenshot endpoint to exploit CVE-2025-32778.modules/exploits/multi/http/web_check_screenshot_rce.rb:88modules/exploits/multi/http/web_check_screenshot_rce.rb:96
Vulnerability Check Method: Sleep-based timing analysisThe check method sends sleep commands of varying durations and measures response time to confirm command injection without executing a payload.modules/exploits/multi/http/web_check_screenshot_rce.rb:110-117
Payload Delivery: User-supplied payload.encoded injected into URLThe exploit method sends the attacker-chosen payload via the same injection vector, which is standard Metasploit behavior.modules/exploits/multi/http/web_check_screenshot_rce.rb:133-135

Review boundaries

What the analysis did not establish

Analysis is based on the module source code and metadata only; framework mixins, libraries, and external payloads are not included.
The artifact was not executed; classification is based on static analysis of the provided Ruby code.
Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
Binary files were not inspected (none present in this evidence).
The review does not assess the safety or reliability of the module when executed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2025-32778