SAP-CVE-2025-31324 POC

A tool to detect and exploit a critical unauthenticated file‐upload vulnerability in SAP NetWeaver Visual Composer.

Description

SAP NetWeaver Visual Composer includes a component called Metadata Uploader which lacks proper authorization checks, allowing unauthenticated attackers to upload arbitrary executable files (e.g., JSP, WAR) to the application server and achieve remote code execution.

Affected Products

Product: SAP NetWeaver Visual Composer (VCFRAMEWORK 7.50)

Component: /developmentserver/metadatauploader

SAP Security Note: 3594142

1- Clone repository:

git clone https://github.com/your-org/sap-cve-2025-31324-scanner.git

cd sap-cve-2025-31324-scanner

2- Install dependencies

pip install requests urllib3

chmod +x scanner.py

3- Single target scan

./scanner.py -s sap.example.com:50000 -v

4- Batch scan

./scanner.py -l targets.txt -o report.txt