CVE-2025-13780: pgAdmin 4 <= 8.14 RCE Scanner

A comprehensive vulnerability scanner for CVE-2025-13780, a Remote Code Execution (RCE) vulnerability in pgAdmin 4 versions ≤ 8.14.

🔍 Vulnerability Details

The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block dangerous shell commands (starting with \) using a regular expression. However, this check can be bypassed.

• Vulnerable Regex: (^|\n)[ \t]*\\
• Bypass Methods:
  1. UTF-8 BOM: Prepending \xef\xbb\xbf makes the regex fail to match
  2. CRLF Injection: Using \n\r instead of \n before the backslash

📦 Installation

# Clone the repository
git clone https://github.com/ThemeHackers/CVE-2025-13780.git
cd CVE-2025-13780

# Install dependencies
pip install -r requirements.txt

Dependencies

• requests - HTTP library for API requests
• rich (optional) - Enhanced terminal output with colors and progress bars
• python-socketio & websocket-client (optional) - WebSocket support for exploit mode

🚀 Usage

Single Target Scan

# Basic scan
python3 scanner.py http://localhost:5050

# With authentication
python3 scanner.py http://localhost:5050 --email [email protected] --password admin

# Verbose mode
python3 scanner.py http://localhost:5050 -v

Multi-Target Scan

# Scan from file
python3 scanner.py -f targets.txt

# With multi-threading (default: 5 threads)
python3 scanner.py -f targets.txt --threads 10

# Export results to JSON
python3 scanner.py -f targets.txt -o results.json --json

Command Line Options

🎯 Scanner Features

• Version Detection: Automatically detects pgAdmin version from multiple sources
• Regex Bypass Testing: Tests both BOM and CRLF bypass methods
• Confidence Scoring: Provides vulnerability assessment with confidence levels
• Multi-Target Support: Scan multiple targets with threading support
• JSON Export: Export results for integration with other tools
• Rich Terminal Output: Beautiful formatted output with progress bars

📊 Confidence Scoring

The scanner calculates a confidence score (0-100) based on multiple factors:

Vulnerability Status Determination

For versions ≤ 8.14:

• VULNERABLE (≥55): High confidence - immediate action required
• LIKELY VULNERABLE (≥40): Medium confidence - prioritize patching
• POSSIBLY VULNERABLE (<40): Low confidence - investigate further

For versions > 8.14:

• NOT VULNERABLE: Patched version detected

For unknown versions:

• Status determined by confidence score:
  • LIKELY VULNERABLE (≥70): Medium confidence
  • POSSIBLY VULNERABLE (≥50): Low confidence
  • NOT VULNERABLE (<50): Likely secure

🧪 Testing Environment

Use Docker Compose to set up a vulnerable pgAdmin 4 instance:

docker-compose up -d

• pgAdmin URL: http://localhost:5050
• Email: [email protected]
• Password: admin

🔧 Exit Codes

📝 Sample Output

╔═══════════════════════════════════════════════════════════════╗
║           CVE-2025-13780 pgAdmin 4 Scanner                    ║
║         Regex Bypass Remote Code Execution                    ║
║                                                               ║
║  Affected: pgAdmin 4 <= 8.14                                  ║
╚═══════════════════════════════════════════════════════════════╝

[*] Checking connectivity to http://localhost:5050
[+] Target appears to be pgAdmin
[+] Detected version: 8.14
[+] CSRF token obtained
[!] Version 8.14 is in vulnerable range (<= 8.14)
[*] Testing regex bypass patterns
  [+] BOM bypass: BYPASSED
  [+] CRLF bypass: BYPASSED

⚠️  VULNERABILITY DETECTED  ⚠️

⚠️ Disclaimer

This tool is provided for educational and authorized security testing purposes only.

• Only use on systems you own or have explicit permission to test
• Unauthorized access to computer systems is illegal
• The authors are not responsible for any misuse of this tool

📚 References

• pgAdmin Official Website
• PostgreSQL psql Meta-Commands
• OWASP Command Injection

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.