db
database
MySQL 5.7 database service for WordPress, with persistent storage.
docker-compose.yml:2-11Nimisha17/CVE-2024-9348-poc
PoC files
8 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The README.md provides step-by-step instructions to achieve Remote Code Execution (RCE) on a WordPress instance running the Easy Timer plugin (CVE-2025-9519) by injecting a shell_exec call via a shortcode attribute.
Backdoor review
No backdoor observed in reviewed code
The supplied README.md provides step-by-step instructions for setting up a WordPress environment and demonstrating a Remote Code Execution (RCE) vulnerability in the Easy Timer plugin via a shortcode. The instructions are consistent with the claimed CVE-2025-9519 and do not contain any concealed, deceptive, or operator-directed harmful behavior beyond the documented exploit demonstration.
ClassificationExploit
Model confidence95%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact provides explicit instructions for executing arbitrary commands on a target system via a crafted shortcode, which constitutes exploit code in the form of a documented procedure.
README.md:48-50Requirements
- Docker Engine and Docker Compose installed
README.md:5-6 - WordPress instance with Easy Timer plugin v4.2.1 activated
README.md:19-29 - Authenticated user with Editor-level privileges
README.md:36-39
Observed behavior
- Instructs user to create a post with a shortcode block containing a malicious filter attribute that calls shell_exec to execute an arbitrary system command (ls -l)
README.md:48-50 - Claims successful RCE upon previewing the post
README.md:59
Behaviors behind the backdoor verdict
Observables
- Exploit Instruction
- Shortcode [countdown date=2025/12/17-00:00:00 filter="shell_exec"]ls -l[/countdown]Demonstrates the claimed RCE vulnerability in the Easy Timer plugin by executing the 'ls -l' command on the server.
README.md:49
What the analysis did not establish
- Only the README.md file content is provided; 7 other files in the repository are omitted.
- The analysis is based solely on the supplied text; the exploit was not executed or verified.
- The artifact references multiple CVEs (CVE-2024-9348, CVE-2025-48385, CVE-2025-9519) but the README content only describes exploitation of CVE-2025-9519.
- Only the README.md file was provided for review; 7 other text files in the repository were omitted from the evidence packet.
- No source code, scripts, or binary files were included for analysis.
- The review is limited to the supplied text content and does not verify the actual behavior of the described exploit.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2025-9519Compose · images
Analysis
Environment assessment
A Docker Compose environment running WordPress with MySQL, designed to demonstrate an RCE vulnerability in the Easy Timer plugin.
docker-compose.yml:1-47README.md:1-85Lab assessment
Vulnerability labThe README explicitly describes steps to exploit a remote code execution vulnerability in the Easy Timer plugin, including a shortcode payload that executes a shell command.
README.md:1-85Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
wordpress
web servervulnerable target
WordPress 7.4 with Apache, serving on host port 8000. A bind mount of ./wp-content allows plugin installation. The Easy Timer plugin is installed and activated to demonstrate RCE.
docker-compose.yml:13-25README.md:13-22wpcli
command-line tool
WordPress CLI container used to create an editor user for the exploit scenario.
docker-compose.yml:27-40README.md:30-36How the supplied evidence relates each vulnerability
CVE-2025-9519
Supported by supplied evidence
The README describes an RCE via the Easy Timer plugin's countdown shortcode with a 'filter' parameter set to 'shell_exec', which matches the CVE-2025-9519 identifier in the repository name.
README.md:1-85Requirements and sequence described by the evidence
Prerequisites
- Docker Engine and Docker Compose installed.
README.md:5-6 - Easy Timer plugin version 4.2.1 downloaded and installed.
README.md:13-22 - An editor-level user created via WP-CLI.
README.md:30-36
Evidence-described exercise path
- Start the Docker Compose environment.
README.md:11-12 - Download and install the Easy Timer plugin.
README.md:13-22 - Complete WordPress setup and activate the Easy Timer plugin.
README.md:24-28 - Create an editor user with WP-CLI.
README.md:30-36 - Create a post with a malicious shortcode that executes a shell command.
README.md:40-48
Behaviors behind the stored safety assessment
No harmful behavior observed
The environment is a self-contained vulnerability lab. The exploit targets the WordPress container only, and there is no evidence of host escape, persistence, credential theft, or external communication beyond the documented lab setup.
docker-compose.yml:1-47README.md:1-85What the analysis did not establish
- The packet does not include the Easy Timer plugin source code, so the exact vulnerable code path cannot be verified.
- The repository has multiple aliases (CVE-2024-9348, CVE-2025-48385, CVE-2025-9519), but only CVE-2025-9519 is explicitly associated with the unit; the relationship to the other CVEs is unclear.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.