CVE-2025-13780: pgAdmin 4 <= 8.14 RCE Scanner

A comprehensive vulnerability scanner for CVE-2025-13780, a Remote Code Execution (RCE) vulnerability in pgAdmin 4 versions ≤ 8.14.

🔍 Vulnerability Details

The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block dangerous shell commands (starting with \) using a regular expression. However, this check can be bypassed.

• Vulnerable Regex: (^|\n)[ \t]*\\
• Bypass Methods:
  1. UTF-8 BOM: Prepending \xef\xbb\xbf makes the regex fail to match
  2. CRLF Injection: Using \n\r instead of \n before the backslash

📦 Installation

# Clone the repository
git clone https://github.com/ThemeHackers/CVE-2025-13780.git
cd CVE-2025-13780

# Install dependencies
pip install -r requirements.txt

Dependencies

• requests - HTTP library for API requests
• rich (optional) - Enhanced terminal output with colors and progress bars
• python-socketio & websocket-client (optional) - WebSocket support for exploit mode

🚀 Usage

Single Target Scan

# Basic scan
python3 scanner.py http://localhost:5050

# With authentication
python3 scanner.py http://localhost:5050 --email [email protected] --password admin

# Verbose mode
python3 scanner.py http://localhost:5050 -v

Multi-Target Scan

# Scan from file
python3 scanner.py -f targets.txt

# With multi-threading (default: 5 threads)
python3 scanner.py -f targets.txt --threads 10

# Export results to JSON
python3 scanner.py -f targets.txt -o results.json --json

Command Line Options

Option	Description
target	Target URL (e.g., http://localhost:5050)
-f, --file	File containing list of targets (one per line)
-e, --email	pgAdmin email for authentication
-p, --password	pgAdmin password for authentication
-o, --output	Output file for results
--json	Output results in JSON format
-q, --quiet	Suppress banner and info messages
-v, --verbose	Enable verbose/debug output
-t, --timeout	Request timeout in seconds (default: 10)
--threads	Number of threads for multi-target scanning (default: 5)
--exploit-demo	Run exploit demonstration mode
--exploit	Execute real exploit (requires --lhost)
--lhost	Attacker IP for reverse shell callback
--lport	Attacker port for reverse shell (default: 4444)
--cmd	Custom command to execute (optional)

🎯 Scanner Features

• Version Detection: Automatically detects pgAdmin version from multiple sources
• Regex Bypass Testing: Tests both BOM and CRLF bypass methods
• Confidence Scoring: Provides vulnerability assessment with confidence levels
• Multi-Target Support: Scan multiple targets with threading support
• JSON Export: Export results for integration with other tools
• Rich Terminal Output: Beautiful formatted output with progress bars

📊 Confidence Scoring

The scanner calculates a confidence score (0-100) based on multiple factors:

Factor	Max Points	Details
Version in vulnerable range (≤ 8.14)	40	Version detected as ≤ 8.14
Version unknown	15	When version cannot be determined
Restore endpoint accessible	25	Restore API accessible without auth
Restore endpoint (requires auth)	15	Restore API exists but requires authentication
Both BOM and CRLF bypasses work	25	Both regex bypass methods succeed
One bypass method works	20	Either BOM or CRLF bypass succeeds
Browser endpoint accessible	10	Main pgAdmin interface accessible

Vulnerability Status Determination

For versions ≤ 8.14:

• VULNERABLE (≥55): High confidence - immediate action required
• LIKELY VULNERABLE (≥40): Medium confidence - prioritize patching
• POSSIBLY VULNERABLE (<40): Low confidence - investigate further

For versions > 8.14:

• NOT VULNERABLE: Patched version detected

For unknown versions:

• Status determined by confidence score:
  • LIKELY VULNERABLE (≥70): Medium confidence
  • POSSIBLY VULNERABLE (≥50): Low confidence
  • NOT VULNERABLE (<50): Likely secure

🧪 Testing Environment

Use Docker Compose to set up a vulnerable pgAdmin 4 instance:

docker-compose up -d

• pgAdmin URL: http://localhost:5050
• Email: [email protected]
• Password: admin

🔧 Exit Codes

Code	Meaning
0	No vulnerabilities found
1	One or more vulnerable targets found
2	Scan errors occurred

📝 Sample Output

╔═══════════════════════════════════════════════════════════════╗
║           CVE-2025-13780 pgAdmin 4 Scanner                    ║
║         Regex Bypass Remote Code Execution                    ║
║                                                               ║
║  Affected: pgAdmin 4 <= 8.14                                  ║
╚═══════════════════════════════════════════════════════════════╝

[*] Checking connectivity to http://localhost:5050
[+] Target appears to be pgAdmin
[+] Detected version: 8.14
[+] CSRF token obtained
[!] Version 8.14 is in vulnerable range (<= 8.14)
[*] Testing regex bypass patterns
  [+] BOM bypass: BYPASSED
  [+] CRLF bypass: BYPASSED

⚠️  VULNERABILITY DETECTED  ⚠️

⚠️ Disclaimer

This tool is provided for educational and authorized security testing purposes only.

• Only use on systems you own or have explicit permission to test
• Unauthorized access to computer systems is illegal
• The authors are not responsible for any misuse of this tool

📚 References

• pgAdmin Official Website
• PostgreSQL psql Meta-Commands
• OWASP Command Injection

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

---