Dungsocool/CVE-2025-7384

GitHubRepository PoCWriteup

PoC files

19 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup analyzing CVE-2025-7384, a PHP Object Injection vulnerability in the 'Database for Contact Form 7' WordPress plugin. The document provides root cause analysis, attack chain description, and step-by-step reproduction instructions, but does not contain executable exploit or scanner code.

Backdoor review

Suspicious behavior

The PoC documentation describes a legitimate PHP Object Injection exploit against the stated target plugin. However, the final RCE stage instructs the operator to upload a webshell from a supplied ZIP file (`system-health.zip` or `system-monitor.zip`). This ZIP is present in the repository as an uninspected binary, and its behavior is not disclosed in the readable text. The operator is directed to install and activate this opaque plugin on a compromised host, which creates a material concern about concealed, operator-directed harmful behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdownphpbash
Target softwareWordPressDatabase for Contact Form 7 plugin (contact-form-entries)
Attack typesPHP Object InjectionRemote Code ExecutionArbitrary File Deletion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a technical report (writeup) that explains the vulnerability, its root cause, and a reproduction process. It does not provide any standalone executable code to exploit or scan for the vulnerability; the described steps require manual interaction and external tools (Docker, a webshell ZIP). The content is purely analytical and instructional.

CVE-2025-7384_Report_EN.md:1-394

Requirements

  • Target must run WordPress with the vulnerable 'contact-form-entries' plugin (≤ 1.4.3) and Contact Form 7.CVE-2025-7384_Report_EN.md:3
  • A POP chain (e.g., a class with a __destruct() method calling unlink()) must be available in the environment.CVE-2025-7384_Report_EN.md:29

Observed behavior

  • Describes how an unauthenticated attacker can inject a serialized PHP object via a Contact Form 7 form field.CVE-2025-7384_Report_EN.md:199-203
  • Explains that the payload is stored in the database and deserialized via maybe_unserialize() when an admin views the entry.CVE-2025-7384_Report_EN.md:86-96
  • Outlines a multi-stage attack chain culminating in arbitrary file deletion and remote code execution via WordPress reinstallation.CVE-2025-7384_Report_EN.md:193-232
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Executable Behavior
  • The PoC instructs the operator to upload and activate a webshell plugin from a supplied ZIP file (`system-health.zip` or `system-monitor.zip`). The ZIP is flagged as an uninspected binary, and its internal code is not disclosed in the reviewed text. The operator is directed to execute this opaque payload on a target system without any inspection of its behavior.CVE-2025-7384_Report_EN.md:312-316

Observables

Binary Artifact
system-health.zipSupplied ZIP file intended to be uploaded as a WordPress plugin webshell. Its contents are uninspected, and the PoC text does not reveal its internal code.CVE-2025-7384_Report_EN.md:312
Review boundaries

What the analysis did not establish

  • The artifact contains references to binary files (e.g., system-health.zip) and images that were not analyzed, but the text content is complete.
  • The analysis is based solely on the supplied text; no code was executed to verify the described behavior.
  • The `system-health.zip` binary is uninspected; its internal code and any hidden behavior are not reviewed.
  • Only two text files from the repository were provided; other files, including potential plugin source code, were omitted.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-7384Compose · mixed

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a CVE-2025-7384 vulnerability lab, consisting of a MySQL 5.7 database and a WordPress service with a vulnerable contact-form-entries plugin. The lab demonstrates unauthenticated PHP object injection leading to remote code execution.

docker-compose.yml:1-42README.md:1-394

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2025-7384), its root cause, and a step-by-step reproduction. The Docker Compose file sets up a WordPress instance with a vulnerable plugin, and setup.sh installs the vulnerable plugin and a lab POP gadget. The poc.py script automates the exploit chain. All components are directed at demonstrating the vulnerability.

README.md:1-10docker-compose.yml:1-42setup.sh:1-159poc.py:1-440
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

databaseMySQL 5.7

MySQL 5.7 database service for WordPress. Stores form entries including the serialized payload.

docker-compose.yml:4-14

wordpress

web applicationvulnerable target

WordPress service built from a Dockerfile (not provided). Runs the vulnerable contact-form-entries plugin and a lab POP gadget. Exposes port 8181 for HTTP access. Mounts ./wp-src for source code debugging.

docker-compose.yml:16-35setup.sh:1-159

setup.sh

lab initializervulnerability enabler

Bash script that installs WordPress, the vulnerable contact-form-entries plugin (version 1.4.3), Contact Form 7, creates a contact page, and installs a lab POP chain gadget (VulnerableFileHandler) as a mu-plugin. Also makes wp-config.php writable for the exploit.

setup.sh:1-159

poc.py

exploit scriptautomation

Python script that automates the full attack chain: injects a serialized PHP object via the CF7 form, triggers deserialization by simulating admin login, verifies wp-config.php deletion, reinstalls WordPress with attacker credentials, and uploads a webshell for RCE.

poc.py:1-440

VulnerableFileHandler (lab gadget)

POP chain gadgetlab-only

A PHP class installed as a mu-plugin by setup.sh. Its __destruct() method deletes a file specified in the $file_path property when $cleanup is true. Used to demonstrate the impact of the deserialization vulnerability.

setup.sh:120-137
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-7384

Supported by supplied evidence

The README, poc.py, and setup.sh all explicitly reference CVE-2025-7384 and describe a PHP object injection vulnerability in contact-form-entries ≤ 1.4.3. The lab installs the vulnerable version and provides a complete exploit chain matching the CVE description.

README.md:1-10poc.py:1-10setup.sh:1-159
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:1
  • The lab must be started with 'docker-compose up --build -d' and wait for 'LAB READY' message.README.md:1
  • The target WordPress site must have Contact Form 7 and the vulnerable contact-form-entries plugin active.poc.py:1
  • An admin must view the injected form entry to trigger deserialization (simulated by poc.py).README.md:1

Evidence-described exercise path

  1. Start the Docker lab: docker-compose up --build -dREADME.md:1
  2. Inject a serialized PHP object payload into the 'your-message' field of the CF7 form on /contact/.README.md:1
  3. Log in as admin (admin/admin123) and view the CRM Entries to trigger deserialization, which deletes wp-config.php.README.md:1
  4. Verify wp-config.php deletion by accessing the site and seeing the WordPress installation wizard.README.md:1
  5. Reinstall WordPress with attacker-controlled admin credentials.README.md:1
  6. Upload a webshell plugin and execute commands to achieve RCE.README.md:1
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own WordPress container. The exploit deletes wp-config.php within the container, reinstalls WordPress, and uploads a webshell—all actions confined to the lab environment. No evidence of host escape, external connections, persistence outside the lab, credential theft, or destructive behavior beyond the intended demonstration.

poc.py:1-440setup.sh:1-159docker-compose.yml:1-42
Review boundaries

What the analysis did not establish

  • The Dockerfile referenced in docker-compose.yml (build: .) is not included in the evidence packet, so the WordPress image contents cannot be fully verified.
  • The wp-src directory mounted into the container is not provided, so the exact source code of the vulnerable plugin cannot be confirmed from the packet alone.
  • The system-health.zip file is listed in the file inventory but its contents are not included as text; it is a binary ZIP file and was not inspected.
  • The lab uses a custom POP gadget (VulnerableFileHandler) that is not part of a real WordPress installation; the real-world exploitability depends on available gadgets in the target environment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1