itsismarcos/sneeitscanner-cve-2025-6389SneeitScanner - PoC & Scanner para RCE não autenticada no Sneeit Framework (CVE-2025-6389)
SneeitScanner - PoC & Scanner for Unauthenticated RCE in Sneeit Framework (CVE-2025-6389)
This robust Python script is a functional PoC and scanner tool for CVE-2025-6389, a critical unauthenticated Remote Code Execution (RCE) vulnerability (CVSS 9.8) affecting Sneeit Framework <= 8.3.
The exploit takes advantage of unsafe handling of the callback parameter in the sneeit_articles_pagination AJAX function, allowing command injection through the assert function.
This material is strictly for educational and security research purposes. Use it only on systems where you have explicit written permission to perform penetration testing. Unauthorized use is strictly prohibited.
phpinfo() payload for silent RCE confirmation.--list): Iterates over a text file with multiple URLs, automating the check and command execution.# Runs 'whoami' on all vulnerable targets listed in targets.txt
python3 SneeitScanner.py --list targets.txt 'whoami'