GitHub Exploit Metadata - Exploit Intel

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

Nuclei templates that detect potentially vulnerable Oracle E-Business Suite instances by checking for a specific body string and comparing the Last-Modified header date against a patch timestamp. No exploitation code is present.

Backdoor review

No backdoor observed in reviewed code

The repository contains two Nuclei detection templates and a README. The templates perform passive HTTP GET requests, extract the Last-Modified header, convert it to a Unix timestamp, and compare it against a fixed date to determine if an Oracle E-Business Suite instance is potentially unpatched. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text files.

ClassificationScanner

Model confidence98%

AuthenticationNot required

Languagesyaml

Target softwareOracle E-Business Suite

Attack typesdetection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The YAML files are Nuclei templates that only perform detection by matching response characteristics and comparing dates. They do not contain any code to exploit the vulnerability, execute commands, or gain unauthorized access. The README explicitly describes them as 'detection templates'.

CVE-2025-61882.yaml:4README.md:10

Requirements

Target must be an Oracle E-Business Suite instance serving the 'E-Business Suite Home Page' string in the response body.CVE-2025-61882.yaml:33-35
Target must return a Last-Modified header with a date before the patch cutoff (Unix timestamp 1759602752 for CVE-2025-61882, 1760198400 for CVE-2025-61884).CVE-2025-61882.yaml:37-39CVE-2025-61884.yaml:37-39

Observed behavior

Sends an HTTP GET request to the target base URL.CVE-2025-61882.yaml:14-16
Extracts the Last-Modified header value and converts it to a Unix timestamp.CVE-2025-61882.yaml:18-28
Matches if the response body contains 'E-Business Suite Home Page', the converted timestamp is less than the patch cutoff, and the HTTP status is 200.CVE-2025-61882.yaml:30-43

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request: GET {{BaseURL}}The templates issue a single HTTP GET request to the target to retrieve headers and body for version fingerprinting.CVE-2025-61882.yaml:14-16CVE-2025-61884.yaml:14-16
Date Comparison: compare_versions(date_unix, "< 1759602752")CVE-2025-61882 template checks if the Last-Modified date is before October 4, 2025, indicating a potentially unpatched instance.CVE-2025-61882.yaml:37-39
Date Comparison: compare_versions(date_unix, "< 1760198400")CVE-2025-61884 template checks if the Last-Modified date is before October 11, 2025, indicating a potentially unpatched instance.CVE-2025-61884.yaml:37-39
Contact Information: Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwThe README provides a Signal contact link for questions; this is author contact information and not a backdoor indicator.README.md:48

Review boundaries

What the analysis did not establish

One file (LICENSE) was omitted from the packet and not analyzed.
The detection logic relies on the Last-Modified header as a proxy for patch status, which may produce false positives or negatives if the header is not updated consistently with patching.
One text file (LICENSE) was omitted from the packet and not reviewed; its content is unknown.
One binary file (unclassified, 1073 bytes) was flagged as metadata-only and not analyzed; its content is unknown.
The review is limited to the supplied evidence and does not assess the safety of external links (e.g., Signal, Twitter, LinkedIn) or the Nuclei tool itself.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

rxerium/CVE-2025-61882-CVE-2025-61884