POC# PoC for CVE-2025-24893 — XWiki Remote Code Execution (Safe PoC)
**PoC for CVE-2025-24893:** XWiki' Remote Code Execution exploit for versions prior to **15.10.11**, **16.4.1** and **16.5.0RC1**.
> ⚠️ **IMPORTANT — AUTHORIZED TESTING ONLY**
> This repository contains a *proof-of-concept* (PoC) project intended for **educational** and **authorized vulnerability testing**. Do **not** use any exploit code or techniques against systems you do not own or do not have explicit written permission to test. Unauthorized use may be illegal.
---
## Overview
- **CVE:** CVE-2025-24893
- **Product:** XWiki Platform
- **Affected versions (reported):** versions prior to **15.10.11**, **16.4.1**, and **16.5.0RC1**.
- **Impact:** Remote Code Execution (RCE) via code (Groovy) injection when certain endpoints render untrusted content.
- **PoC intent:** Demonstrate that arbitrary code execution is possible in a controlled environment — *this README and associated scripts are sanitized for safe, responsible use*.
---
## What this repository provides (safe mode)
- A **non-destructive PoC script** that demonstrates how an RCE condition might be triggered, **without** containing working exploit payloads (no reverse shells, no malicious one-liners).
- A robust **test harness** for sending benign commands (e.g. `uname -a`, `echo "POC OK"`) to a target XWiki instance you control.
---
## Requirements
- Python 3.8+
- `requests` Python package:
```bash
pip install requests
登录后查看神龙缓存的 POC 文件快照
登录查看