Jenderal92/laravel-filemanager-unrestricted-upload
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python 2.7 script (lfm.py) that automates the exploitation of CVE-2025-56399 in alexusmai/laravel-file-manager. It detects vulnerable endpoints, extracts CSRF tokens, uploads a PHP web shell disguised as a GIF, and verifies remote code execution by accessing the shell.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2025-56399. The Python script (lfm.py) automates the documented attack chain: detecting a vulnerable FileManager, extracting a CSRF token, uploading a PHP web shell disguised as a GIF, and verifying its execution. The uploaded PHP payload provides a file upload form and system information, which is standard behavior for a web shell used in a PoC. No concealed backdoor, unrelated remote access, credential theft, persistence mechanism, or deceptive payload targeting the PoC operator was observed. The script's actions are consistent with the described exploit and do not exhibit hidden harmful functionality.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP web shell to a target server and verifies its execution, which constitutes exploitation, not just detection or scanning. The README explicitly describes it as a 'Proof of Concept (PoC)' that 'automates the entire process' of achieving RCE.
lfm.py:126-132README.md:10-17Requirements
- Valid authentication credentials for the target Laravel application.
lfm.py:1 - The target must have alexusmai/laravel-file-manager (≤ 3.3.1) installed and accessible.
README.md:10
Observed behavior
- Probes common FileManager paths to detect the presence of the vulnerable component.
lfm.py:38-43 - Extracts CSRF token from the page source to authenticate subsequent requests.
lfm.py:55-63 - Uploads a .htaccess file and a PHP web shell (shxt_<timestamp>.php) with a GIF MIME type to the server.
lfm.py:117-132 - Verifies successful exploitation by accessing the uploaded shell with a specific parameter and checking for a unique string.
lfm.py:148-153 - Saves the URL of the verified web shell to a file named valid.txt.
lfm.py:152-153
Behaviors behind the backdoor verdict
Observables
- Web Shell Payload
- PHP code that displays system info and provides a file upload form when accessed with ?shinday=1, otherwise outputs a GIF header.This is the payload uploaded to the target server as part of the PoC. It is a standard web shell used to demonstrate RCE, not a backdoor targeting the PoC operator.
lfm.py:126 - Uploaded File
- .htaccess file with mod_rewrite rulesThe script attempts to upload an .htaccess file to the target server. This is part of the exploit to potentially bypass restrictions, not a backdoor against the operator.
lfm.py:117-124
What the analysis did not establish
- The evidence does not include any authentication credentials or session handling logic; the script assumes the user is already authenticated or that the target does not require authentication for the file manager endpoints.
- The script uses Python 2.7, which is end-of-life, and may not function correctly in modern environments without modification.
- The evidence is limited to the source code and README; no network traffic, server responses, or execution logs are provided to confirm the exploit's effectiveness.
- Only the three text files in the repository were reviewed; no binary or non-text files were present.
- The review does not assess the safety or legality of executing the PoC against any system.
- The analysis is limited to the supplied evidence and does not inspect external dependencies or runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.