sap_netweaver_cve-2025-31324-

This repository does not have a README...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2020-6286

CVE-2020-6286 SAP NetWeaver AS JAVA LM Configuration Wizard Directory Traversal SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented application and integration platform that provid...

CVE-2025-31324

Info ░█▄█░█▀█░█░█░█░█░█░█░▀█▀░█▀█░█▀█░█▀▄░█░█ ░█░█░█▀▀░█░█░█░█░█▄█░░█░░█░█░█░█░█▀▄░░█░ ░▀░▀░▀░░░▀▀▀░▀▀▀░▀░▀░▀▀▀░▀░▀░▀░▀░▀░▀░░▀░ N U L L T R A C E // NullTrace :: No logs. No noise. Just signal. // ----- SIGNATURE----- Key: ssh-rsa AAAAB3...NullKey...KFA== Fingerprint:...

jsp-webshell-scanner

JSP Webshell Scanner for SAP CVE-2025-31324 and PeopleSoft IOC Triage A lightweight script to scan .jsp and .jspx files for suspicious patterns typically associated with JSP-based webshells, including those observed in attacks exploiting SAP NetWeaver CVE-2025-31324. This scanner has also been...

Onapsis_CVE-2025-31324_Scanner_Tools

Vulnerability and Indicator of Compromise IoC Scanner for CVE-2025-31324 Visual Composer Metadata Uploader Vulnerability CVE-2025-31324 is a critical CVSSv3 10 vulnerability affecting SAP NetWeaver systems, specifically within the Visual Composer Metadata Uploader component. This vulnerability...

CVE-2020-6287-Sap-Add-User

CVE-2020-6287-Sap-Add-User sap netweaver portal add user administrator...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

CVE-2025-31324

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticated File Upload Type: Proof of Concept — Vulnerability Research CVE: CVE-2025-31324 CVSS: 10.0 Critical AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Status: Patched — SAP Security Note 3594142 + 3604119 Added to CISA KEV: May 2025 ⚠️ Este PoC...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this hel...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

CVE-2025-31324

CVE-2025-31324 由 ShinyHunters 创建的 SAP NetWeaver 0day 概念验证 CVE-2025-31324 是一个影响 SAP NetWeaver 应用服务器 AS Java 的严重“不受限制文件上传”漏洞。具体而言，它存在于 Visual Composer 组件（VCFRAMEWORK）中。 该漏洞允许未经身份验证的远程攻击者向服务器上传任意文件（例如 Web Shell）。成功利用可实现远程代码执行 RCE，具有 SAP 服务用户（通常为 sidadm）的权限，从而导致系统完全沦陷。 CVSS v3 评分：10.0（严重）...

CVE-2025-42944

CVE-2025-42944 Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution,...

SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

SAP NetWeaver Memory Corruption (3757002)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3757002: - SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that...

SAP NetWeaver Information Disclosure (3750721)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an information disclosure vulnerability as referenced in SAP Security Note 3750721: - SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to...

SAP NetWeaver Memory Corruption (3747649)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747649: - A memory safety vulnerability exists in the Extended Passport Protocol EPP processing library. Under specific conditions, an...

SAP NetWeaver AS Java Denial of Service (3736494)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a denial of service vulnerability as referenced in SAP Security Note 3736494: - SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested...

SAP NetWeaver Missing Authentication (3759472)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a missing authentication vulnerability as referenced in SAP Security Note 3759472: - SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during...

CVE-2026-76967

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...