Galaxy-sc/CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go program that fetches a target URL, searches the page source for a 'var igd' JavaScript variable, and parses it to check for exposed Google OAuth credentials and account data. It reports whether sensitive data was found but does not perform any exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code and README implement a straightforward proof-of-concept for CVE-2025-12139. The program fetches a target URL, extracts a JavaScript variable with a regex, parses JSON, and prints any discovered Google OAuth credentials. No hidden network calls, persistence mechanisms, credential exfiltration to a third party, or unrelated payloads are present. The behavior is fully consistent with the stated information-disclosure exploit.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesGo
Target softwareWordPress Plugin Integrate Google Drive
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code only detects and reports the presence of exposed sensitive data; it does not perform any action to exploit the vulnerability such as using the credentials to access Google Drive or modify data. The README describes it as a 'Proof of Concept (PoC) exploit' but the code itself is a scanner.

CVE-2025-12139.go:1-134README.md:4

Requirements

  • Target URL must be provided via -u flagCVE-2025-12139.go:53-54
  • Target must have the Integrate Google Drive plugin active and exposing the 'igd' variable in page sourceCVE-2025-12139.go:78-84

Observed behavior

  • Fetches the target URL via HTTP GETCVE-2025-12139.go:66-67
  • Extracts the 'igd' JavaScript variable from the response body using a regexCVE-2025-12139.go:78-79
  • Parses the extracted JSON and checks for clientID, clientSecret, and Base64-encoded accounts dataCVE-2025-12139.go:89-127
  • Prints whether the target is vulnerable based on the presence of sensitive dataCVE-2025-12139.go:129-133
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
HTTP GET to user-supplied -u target URLThe only outbound connection is the intended exploit request to the victim WordPress site; no hardcoded attacker-controlled server is contacted.CVE-2025-12139.go:67
Credential Extraction
Parses 'igd' JSON for clientID, clientSecret, and Base64-encoded accountsMatches the described CVE-2025-12139 information disclosure; extracted data is only printed to stdout, not exfiltrated elsewhere.CVE-2025-12139.go:99-121
Author Contact
Telegram: t.me/Dread_NetDisplayed in the banner; no code uses this for communication or data exfiltration.CVE-2025-12139.go:47
Review boundaries

What the analysis did not establish

  • One non-text file (proof.PNG) is present but not included in the text evidence; its content cannot be analyzed.
  • The evidence packet reports complete_artifact_coverage: false, indicating not all files are represented, though all selected text files are complete.
  • One non-text media file (proof.PNG, 13837 bytes) was flagged as metadata-only and not analyzed; its content could theoretically contain hidden instructions, but the text-based PoC code itself shows no backdoor behavior.
  • The review covers only the supplied evidence packets; no runtime behavior or external dependencies were examined.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1