Jenderal92/magento-upload-auto-submit-zoneh

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-54236 in Adobe Commerce/Magento by uploading an arbitrary file via the /customer/address_file/upload endpoint, verifying its public accessibility, and automatically submitting the defacement to Zone-H.

Backdoor review

Suspicious behavior

The PoC for CVE-2025-54236 is a Magento file upload exploit. After a successful upload, the script automatically submits the defacement URL to the Zone-H defacement archive without any operator configuration or opt-in. This automatic submission is a materially concealed, non-consensual data exfiltration that sends exploit results to a third party, contradicting the tool's stated purpose of authorized security testing.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareAdobe CommerceMagento
Attack typesarbitrary file uploaddefacement
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a file containing a defacement message to a target server and verifies its public accessibility, which constitutes exploitation rather than mere detection or scanning.

blabla.py:96-155blabla.py:186-195

Requirements

  • Target must be running a vulnerable version of Adobe Commerce/Magento with the /customer/address_file/upload endpoint exposed.blabla.py:126
  • Attacker must provide a list of target hosts in a text file.blabla.py:200

Observed behavior

  • Sends a POST request to /customer/address_file/upload with a crafted multipart form containing a file payload disguised as a country_id custom attribute.blabla.py:110-132
  • Parses the JSON response to extract the uploaded file path and verifies the file is publicly accessible by requesting it from multiple potential media directories.blabla.py:137-148
  • Automatically submits the URL of the successfully uploaded file to the Zone-H defacement archive.blabla.py:157-179
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Data Exfiltration
  • The script automatically submits the URL of a successfully uploaded file to the Zone-H defacement archive (http://www.zone-h.org/notify/single) without any operator configuration, opt-in, or disclosure in the README. This sends the target's domain and the fact of a successful exploit to a third party, which is a concealed harm separate from the disclosed exploit.blabla.py:157-179blabla.py:192

Observables

Url
http://www.zone-h.org/notify/singleThird-party defacement archive endpoint to which successful exploit results are automatically submitted.blabla.py:173
Domain
zone-h.orgDomain of the third-party service receiving automatic submissions.blabla.py:173
Review boundaries

What the analysis did not establish

  • The review does not assess the validity or reachability of the Zone-H endpoint.
  • The review does not determine whether the operator is aware of or consents to the Zone-H submission.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1