CVE-2025-63406

This repository contains a functional exploit for CVE-2025-63406, demonstrating remote command execution (RCE) in GroupOffice via crafted API requests to create a malicious FunctionField that executes system commands.

This PoC exploits CVE-2025-63406 in GroupOffice by creating a custom field with a malicious function that executes arbitrary system commands. The exploit chains authentication, field creation, and data extraction to demonstrate RCE.

This is a functional PoC exploit for CVE-2025-63406, targeting GroupOffice. It demonstrates authenticated remote code execution (RCE) by creating a malicious FieldSet and executing arbitrary commands via a reverse shell payload.

This repository contains a functional exploit for CVE-2025-63406, targeting GroupOffice. The exploit leverages a vulnerability in the FieldSet and Field creation API endpoints to achieve remote code execution (RCE) by injecting a system command into a FunctionField.