CVE-2025-69460

Search associated code STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC to CVE-2025-69460.

Exploitation context

Available material

Repository PoCs
1

Proofs of concept

1

Repository PoCs

GitHubTagoletta/CVE-2025-69460Repository PoCby Tagoletta0Exploit2 files

3.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs SQL injection login bypass and uploads a PHP web shell to achieve remote code execution on a target Simple Image Gallery application.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (CVE-2025-69460.py) that automates exploitation of CVE-2025-69460, a known RCE vulnerability in Simple Image Gallery 1.0. The script performs a SQL injection login bypass, uploads a PHP webshell, and prints the shell URL. All actions are consistent with the stated purpose of demonstrating the CVE. No concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareSimple Image Gallery
Attack typesSQL InjectionRemote Code ExecutionAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits a SQL injection vulnerability to bypass login, then uploads and deploys a PHP web shell to execute arbitrary commands on the target. This constitutes an exploit, not merely a scanner or writeup.

CVE-2025-69460.py:14CVE-2025-69460.py:20-22CVE-2025-69460.py:52-55

Requirements

  • Target must be running Simple Image Gallery web application.README.md:1

Observed behavior

  • Prompts user for target URL and normalizes it.CVE-2025-69460.py:7-12
  • Defines a PHP web shell payload that executes system commands via 'cmd' GET parameter.CVE-2025-69460.py:14
  • Sends a POST request to /classes/Login.php?f=login with SQL injection payload in username field to bypass authentication.CVE-2025-69460.py:20-22
  • If login bypass succeeds, fetches user profile page to extract user details (id, firstname, lastname, username).CVE-2025-69460.py:36-43
  • Uploads the PHP web shell via a multipart POST request to /classes/Users.php?f=save, embedding the shell as the user's profile image.CVE-2025-69460.py:52-55
  • If upload succeeds, retrieves the shell URL from the user profile page and prints it with a 'cmd=whoami' example.CVE-2025-69460.py:57-62
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
PHP webshell uploaded to target server via file upload vulnerabilityThe script uploads a PHP file containing a simple command execution webshell (system($_GET['cmd'])) to the target server. This is the expected behavior for a PoC exploiting the stated RCE vulnerability.CVE-2025-69460.py:14CVE-2025-69460.py:50-55
Sql Injection
SQL injection login bypass using admin' or '1'='1'#The script performs a SQL injection to bypass authentication on the target application. This is a standard technique for exploiting the referenced vulnerability.CVE-2025-69460.py:21-22
Target Interaction
Script prompts user for target URL and interacts only with that targetThe script takes a single target URL as input and all subsequent HTTP requests are directed to that target. No external or unrelated network communication is present.CVE-2025-69460.py:7-12
Review boundaries

What the analysis did not establish

  • CVE-2025-69460 record is absent from the acquired CVEList V5 dataset, so official vulnerability details are not available for cross-reference.
  • The README.md references an external writeup and ExploitDB entry, but those resources are not included in the evidence.
  • Review is limited to the supplied text files; no binary or non-text media were present.
  • The script's behavior depends on the target server's response; no dynamic analysis was performed.
  • The CVE record was absent from the acquired CVEList, so the script's alignment with the official CVE description could not be verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.