howiehz/cve-2025-70886A Proof of Concept (PoC) exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS (v2.22.4 and earlier) that allows remote attackers to crash the admin comment interface by submitting malformed payloads.
A Proof of Concept (PoC) exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS (v2.22.4 and earlier) that allows remote attackers to crash the admin comment interface by submitting malformed payloads.
An issue in Halo v2.22.4 and earlier allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint.
An attacker can submit a crafted/malformed comment payload (missing fields such as subjectRef.version) via the public comment submission endpoint. The malformed comment is stored and later triggers an unhandled exception when the admin comment page reads/renders it, resulting in a persistent denial of service for the comment management page until the offending record is removed or server-side validation/handling is fixed.
At the end of the run, the Summary job publishes a table showing each Halo version and its status:
likely_vulnerable — API returned HTTP 500 during the check.not_confirmed — API did not return HTTP 500.⚠️ Warning: For authorized testing environments only
Clone the PoC repository
git clone https://github.com/HowieHz/CVE-2025-70886
cd CVE-2025-70886
Deploy a Halo CMS test instance
Initialize the system
Execute the PoC script (Ensure the Node.js environment is configured.)
node src/poc.js --base-url http://localhost:8090 --payload fixtures/payload.sample.json
Available options:
--base-url: Halo site base URL (e.g., http://localhost:8090)--payload: Path to a captured, valid comment payload JSON file--dry-run: Only print modified payload, do not send--header: Extra header in 'Key: Value' form (repeatable)--help: Show helpVerify the vulnerability