richard-natan/poc-cve-2025-63406Proof-of-concept for CVE-2025-63406 in GroupOffice, demonstrating API-based object manipulation and authentication flow for vulnerability analysis and patch validation in controlled environments.
This repository contains a research-oriented Proof of Concept (PoC) related to the security issue CVE-2025-63406, affecting the GroupOffice platform.
The purpose of this project is to study and understand the vulnerability’s behavior, assist security teams in risk evaluation, and help validate patches and mitigations in controlled environments.
⚠️ Important Notice
This PoC is provided strictly for authorized security research, auditing, and educational analysis.
It must not be used against systems without explicit permission.
CVE-2025-63406 describes a condition in which internal handling of GroupOffice objects—specifically FieldSet, Field, and Task entities—may lead to unintended behavior under certain circumstances.
This project aims to:
The provided source code focuses on the logic flow, not on enabling exploitation.
The PoC script demonstrates:
/api/jmap.php).This structure is intended for analysis and understanding of internal behavior rather than practical exploitation.
This PoC assists researchers in:
To run the PoC in a safe, isolated research environment, you will need:
requests libraryThis project must only be used for:
✔️ Internal security auditing
✔️ Research and vulnerability analysis
✔️ Patch validation
✔️ Educational study in isolated labs
python3 CVE-2025-63406.py \
--target <TARGET_URL> \
--username <USERNAME> \
--password <PASSWORD> \
--command <TEST_COMMAND>
See the requirements.txt file for Python dependencies.