imbas007/cve-2025-53770-vulnerable-scannerPython script to scan SharePoint hosts for CVE-2025-53770 using custom payloads, with optional Burp Suite proxy interception for traffic analysis and vulnerable host logging.
This script checks a list of SharePoint hosts for vulnerability to CVE-2025-53770 using a custom payload and routes all requests through Burp Suite's proxy for interception and analysis.
http://127.0.0.1:8080).vulnerable_hosts.txt after the scan.[VULNERABLE], [SAFE], or [ERROR] for each target.requests library ()pip install requestsconfig.json (scanner config)payload.json (POST data for the exploit)live_list.txt)config.json: Contains detection rules, endpoints, headers, etc.payload.json: Contains only the POST data, e.g.:
{
"MSOTlPn_Uri": "https://{host}/_controltemplates/15/AclEditor.ascx",
"MSOTlPn_DWP": "<your payload here>"
}
live_list.txt: List of targets (one per line, IP or hostname only, no protocol).127.0.0.1:8080.For a list of targets:
python3 Vul_Sacnner.py -l live_list.txt --payload payload.json
For a single target:
python3 Vul_Sacnner.py -t 1.2.3.4 --payload payload.json
After the scan, check vulnerable_hosts.txt for the list of vulnerable hosts.