Apache OFBiz < 24.09.02 - Unauthenticated Remote Code Execution via Scrum Plugin
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-54466. PoCs published by exploitintel.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-54466, demonstrating Remote Code Execution (RCE) in Apache OFBiz via SVN argument injection. The exploit leverages the `--diff-cmd` flag in SVN commands to execute arbitrary commands, with output returned in the HTTP response.
Description
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Exploits (1)
This repository contains a functional exploit for CVE-2025-54466, demonstrating Remote Code Execution (RCE) in Apache OFBiz via SVN argument injection. The exploit leverages the `--diff-cmd` flag in SVN commands to execute arbitrary commands, with output returned in the HTTP response.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
