CVE-2025-29306

CVE-2025-29306 FOXCMS黔狐 콘텐츠 관리 시스템 서비스 매개변수 주입 취약점 一、취약점 소개 FoxCMS는 무료로 상업적 사용이 가능한 오픈소스 웹사이트 관리 시스템으로, PHP+MySQL 아키텍처를 사용합니다. FOXCMS黔狐 콘텐츠 관리 시스템에는 서비스 매개변수 주입 취약점이 존재하며, 공격자는 이 취약점을 이용해 서버 제어권을 획득할 수 있습니다. 二、취약점 영향 FOXCMS黔狐 콘텐츠 관리 시스템 V1.2 三、재현 과정 POC...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 FoxCMS v.1.2.5의 문제로, 원격 공격자가 index.html 구성 요소의 case display page를 통해 임의의 코드를 실행할 수 있습니다. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html 코드 실행 취약점 개요 FoxCMS v.1.2.5의 문제로 인해 원격 공격자가 index.html 구성 요소의 케이스 표시 페이지를 통해 임의 코드를 실행할 수 있습니다. 전체 POC 관련 정보 — CVE-2025-29306 면책 조항 : 이 개념 증명POC은 교육 및 윤리적 테스트 목적으로만 제작되었습니다. 사전 상호 동의 없이 대상을 공격하는 데 이 도구를 사용하는 것은 불법입니다. 모든 해당 지역, 주, 연방 법률을 준수하는 것은 최종...

FOXCMS-CVE-2025-29306-POC

FOXCMS 매개변수 주입 RCE – CVE-2025-29306 이 저장소는 중국 오픈소스 콘텐츠 관리 시스템인 FOXCMS v1.2에 영향을 미치는 원격 코드 실행RCE 취약점에 대한 Python 기반 PoC를 포함합니다. CVE-ID: CVE-2025-29306 영향: FOXCMS v1.2 유형: 서비스 매개변수 주입 → 코드 실행 취약점 요약 FOXCMS는 /images/index.html 엔드포인트의 id 매개변수에서 안전하지 않은 매개변수 구문 분석 메커니즘을 가지고 있습니다. 이로 인해 $@print 표현식을 사용한...

CVE-2025-29306-PoC-FoxCMS-RCE

CVE-2025-29306 - FoxCMS リモートコード実行エクスプロイト FoxCMS のリモートコード実行脆弱性 CVE-2025-29306 に対する Python エクスプロイトです。このツールを使用すると、単一ターゲットのテストや複数ホストの一括スキャンが可能です。 特徴 単一ターゲットまたは一括スキャン機能 マルチスレッドによる高速スキャン コマンド実行結果を含む詳細な出力 自動結果保存機能 リアルタイム進捗レポート 脆弱なホストのクリーンなサマリテーブル インストール root@kitploit: git clone...

FoxCMS v.1.2.5 - Remote Code Execution

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. id: CVE-2025-29306 info: name: FoxCMS v.1.2.5 - Remote Code Execution author: ritikchaddha severity: critical description: | An issue in FoxCMS v.1.2.5 allows a...

day06-foxcms-rce

Day06 — FoxCMS 스타일 RCE CVE-2025-29306 — 교육용 랩 이 작은 랩은 CVE-2025-29306 의 핵심 개념을 재현합니다. 즉, 공격자가 제어하는 입력에 unserialize을 안전하지 않게 사용하여 원격 코드 실행으로 이어지는 것입니다. 이는 최소한의, 의도적으로 취약하게 설계된 교육용 복제본입니다 — FoxCMS 자체가 아닙니다. 빠른 시작 root@kitploit: chmod +x entrypoint.sh docker build -t day6-foxcms . docker run --rm -d ...

Mass-CVE-2025-29306

FoxCMS Mass Exploiter CVE-2025-29306 Uma ferramenta de automação especializada para pesquisadores de segurança realizarem testes de execução remota de comandos RCE em múltiplos alvos. 🛡️ Nota de Segurança Este programa é escrito em Bash e foi criptografado/compilado com SHC Compilador de Scripts...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

EUVD-2026-32029

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

CVE-2026-9609 affects QianFox FoxCMS up to version 1.2.6, targeting the Admin.php Edit function. The vulnerability enables weak password recovery through manipulation of the admin password flow, with remote initiation. Public exploit code exists, and the issue was reported via an issue but not ye...

CVE-2026-9608

CVE-2026-9608 affects QianFox FoxCMS (up to version 1.2.6) in the Administrator Backend, specifically the /Tag/edit function where a manipulated request can trigger cross-site scripting. The vulnerability arises from an unspecified element/function within that file, allowing remote exploitation. ...

EUVD-2026-32028

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...