FOXCMS-CVE-2025-29306-POC

FOXCMS 参数注入 RCE – CVE-2025-29306 本仓库包含一个基于 Python 的 PoC，可复现影响 FOXCMS v1.2（一款中文开源内容管理系统）的远程代码执行（RCE）漏洞。 CVE 编号：CVE-2025-29306 影响版本：FOXCMS v1.2 类型：服务参数注入 → 代码执行 漏洞概述 FOXCMS 在 /images/index.html 端点的 id 参数中使用了不安全的参数解析机制。攻击者可利用 $@print 表达式注入载荷，从而导致 PHP 代码执行。 PoC 使用方法 环境要求 Python 3.x requests 库...

CVE-2025-29306-PoC-FoxCMS-RCE

CVE-2025-29306 - FoxCMS 원격 코드 실행 익스플로잇 CVE-2025-29306에 대한 Python 익스플로잇입니다. FoxCMS의 원격 코드 실행 취약점을 대상으로 합니다. 이 도구를 사용하면 단일 대상 테스트 또는 여러 호스트를 일괄 스캔할 수 있습니다. 기능 단일 대상 또는 대량 스캔 지원 다중 스레드로 빠른 스캔 명령 실행 결과를 포함한 상세 출력 결과 자동 파일 저장 실시간 진행 상황 보고 취약한 호스트의 깔끔한 요약 테이블 설치 root@kitploit: git clone...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 FoxCMS v.1.2.5의 문제로, 원격 공격자가 index.html 구성 요소의 case display page를 통해 임의의 코드를 실행할 수 있습니다. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

CVE-2025-29306

CVE-2025-29306 FOXCMS黔狐コンテンツ管理システムのサービスパラメータインジェクションの脆弱性 一、脆弱性の概要 FoxCMSは、無料で商用利用可能なオープンソースのWebサイト管理システムであり、PHP+MySQLアーキテクチャを採用しています。FOXCMS黔狐コンテンツ管理システムにはサービスパラメータインジェクションの脆弱性が存在し、攻撃者はこの脆弱性を利用してサーバーの制御権を取得できます。 二、影響を受けるバージョン FOXCMS黔狐コンテンツ管理システム V1.2 三、再現手順 POC...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html コード実行の脆弱性 概要 FoxCMS v.1.2.5 には、index.html コンポーネントのケース表示ページを介して、リモート攻撃者が任意のコードを実行できる問題が存在します。 完全な POC 詳細はこちら — CVE-2025-29306 免責事項 : この Proof of Concept POC...

FoxCMS v.1.2.5 - Remote Code Execution

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. id: CVE-2025-29306 info: name: FoxCMS v.1.2.5 - Remote Code Execution author: ritikchaddha severity: critical description: | An issue in FoxCMS v.1.2.5 allows a...

day06-foxcms-rce

Day06 — FoxCMSスタイルのRCE（CVE-2025-29306）— 教育用ラボ この小さなラボは、CVE-2025-29306 の中核となるアイデア、すなわち攻撃者が制御可能な入力に対する unserialize の安全でない使用によるリモートコード実行をシミュレートしています。これは、意図的に脆弱性を持たせた最小限の教育用レプリカであり、FoxCMS そのものではありません 。 クイックスタート root@kitploit: chmod +x entrypoint.sh docker build -t day6-foxcms . docker run --rm -d -p...

Mass-CVE-2025-29306

FoxCMS 대량 익스플로잇 도구 CVE-2025-29306 보안 연구자가 여러 대상에 걸쳐 원격 명령 실행RCE 테스트를 수행할 수 있는 특화된 자동화 도구입니다. 🛡️ 보안 참고사항 이 프로그램은 Bash 로 작성되었으며 SHCShell Script Compiler로 암호화/컴파일되었습니다. 소스 코드는 변조 및 무단 수정을 방지하기 위해 보호됩니다. 📋 요구사항 프로그램이 올바르게 실행되려면 시스템에 다음이 있는지 확인하십시오: curl python3 libxml2-utils xmllint용 🚀 시작하기 1. 대상 준비:...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

EUVD-2026-32029

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

CVE-2026-9609 affects QianFox FoxCMS up to version 1.2.6, targeting the Admin.php Edit function. The vulnerability enables weak password recovery through manipulation of the admin password flow, with remote initiation. Public exploit code exists, and the issue was reported via an issue but not ye...

CVE-2026-9608

CVE-2026-9608 affects QianFox FoxCMS (up to version 1.2.6) in the Administrator Backend, specifically the /Tag/edit function where a manipulated request can trigger cross-site scripting. The vulnerability arises from an unspecified element/function within that file, allowing remote exploitation. ...

EUVD-2026-32028

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...