CVE-2020-25787

CRITICAL

Tiny Tiny RSS < 2020-09-16 - Server-Side Request Forgery via URL Validation Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-25787. PoCs published by Daniel Neagaru.

AI-analyzed exploit summary This exploit leverages a FastCGI injection vulnerability in Tiny Tiny RSS to achieve remote code execution by crafting a malicious RSS feed that writes a backdoor PHP file to the target system.

Description

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.

Exploits (1)

exploitdb WORKING POC

by Daniel Neagaru · pythonwebappsphp

https://www.exploit-db.com/exploits/49606

View Code ZIP pw:eip

This exploit leverages a FastCGI injection vulnerability in Tiny Tiny RSS to achieve remote code execution by crafting a malicious RSS feed that writes a backdoor PHP file to the target system.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Tiny Tiny RSS (versions before 2020-09-16)

No auth needed

Prerequisites: Target must be running Tiny Tiny RSS with vulnerable version · FastCGI must be enabled · Attacker must be able to deliver malicious RSS feed to the target

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →