b1g-b33f/CVE-2020-36708

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action AJAX handler, confirming the presence of CVE-2020-36708 without executing a payload on the target.

Backdoor review

No backdoor observed in reviewed code

The artifact contains a shell script PoC for CVE-2020-36708 and a README. The script sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareWordPressEpsilon Framework
Attack typesssrffunction injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends a single HTTP request designed to cause the target server to make an outbound connection to a user-supplied domain. It does not deliver a payload, establish a shell, or perform any action on the target beyond triggering the vulnerable function. The README explicitly describes this as a non-destructive SSRF demonstration to confirm arbitrary function execution.

README.md:13CVE-2020-36708.sh:6-13

Requirements

  • Target WordPress site running a vulnerable version of a theme using the Epsilon Framework.README.md:4
  • A collaborator or webhook domain to receive the outbound request.CVE-2020-36708.sh:4

Observed behavior

  • Prompts the user for a target domain and a collaborator domain.CVE-2020-36708.sh:3-4
  • Sends a POST request to /wp-admin/admin-ajax.php with action=epsilon_framework_ajax_action and parameters that invoke the Requests::request_multiple method to make the server fetch a URL on the collaborator domain.CVE-2020-36708.sh:6-13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://$target/wp-admin/admin-ajax.phpTarget endpoint for the CVE-2020-36708 exploitCVE-2020-36708.sh:6
Parameter
action=epsilon_framework_ajax_actionVulnerable AJAX action used to trigger function injectionCVE-2020-36708.sh:8
Parameter
args[action][0]=Requests&args[action][1]=request_multipleClass and method invoked via the vulnerabilityCVE-2020-36708.sh:9-10
Url
https://$collab/wp-epsilon-pocCollaborator/webhook URL used to confirm SSRFCVE-2020-36708.sh:11
Review boundaries

What the analysis did not establish

  • Only the supplied text files were analyzed; no binary or opaque content was present.
  • The script's behavior is inferred from static analysis of the source code; it was not executed.
  • Only the two text files (CVE-2020-36708.sh and README.md) were reviewed; no other files exist in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1