SAP CVE-2025-31324 Analyzer

A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of Compromise (IOCs) such as malicious .jsp.

🚀 Features

• Detects vulnerable Visual Composer endpoints
• Scans for known malicious .jsp files (webshells)
• Multi-target scanning from a CSV file
• Custom IOC file support
• Saves results to CSV (optional)
• Optional verbosity

🛠 Requirements

• Python 3.6+
• requests library (installed via requirements.txt)

📦 Installation

# 1. Clone the repository
git clone https://github.com/youruser/CVE-2025-31324.git
cd CVE-2025-31324

# 2. Create and activate virtual environment
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# 3. Install dependencies
pip install -r requirements.txt

📦 File Structure

scan.py                 # Main scanner
targets.csv             # Input list of targets
ioc_list.txt            # Optional IOC signature list
results.csv             # Output report (if --output used)
requirements.txt        # Python dependencies

📄 CSV Input Format

Create a file named targets.csv with the following semicolon-separated format with IP, Port and SSL option:

192.168.1.10;50000;false
myunsafelocation.example.com;443;true
10.0.0.5;8080;false

• ssl: Use true, false, yes, or no

🕵️ IOC List Format

Create a file named ioc_list.txt:

# Default IOCs
cache.jsp
helper.jsp
nzwcnktc.jsp

# Add your own signatures
shell.jsp
webadmin.jsp

⚙️ Usage

python3 scan.py --input targets.csv

Optional Flags:

Example:

python3 scan.py --input targets.csv --iocfile ioc_list.txt --output results.csv --verbose

🎨 Output Explanation

The script prints a result block for each host:

__________________________________
✅ Target 1 : 192.168.1.10:50000
Connection: Online
Status: Not Vulnerable
IOC: None detected
__________________________________

Icons:

🧪 Local Testing

To test locally, run a Python HTTP server simulating a vulnerable SAP system:

mkdir -p test/developmentserver
mkdir -p test/irj
echo "" > test/developmentserver/metadatauploader
echo "<%-- fake webshell --%>" > test/irj/cache.jsp
cd test
python3 -m http.server 8000

Add to targets.csv:

0.0.0.0;8000;false

🛡 Disclaimer

This tool is provided for authorized security testing and research only. Do not use against systems you do not own or have explicit permission to scan.

📬 Feedback

For suggestions or improvements, please open an issue or submit a PR.

⚖ License

This project is licensed under the MIT License.
You are free to use, modify, and distribute it — commercially or privately.

Disclaimer:
This tool is provided as-is, without any warranty or guarantee.
The authors are not responsible for any damage or legal issues caused by its usage.
Use it only in environments where you have explicit authorization to scan and test systems.