React2Shell (CVE-2025-55182) mass exploitation: RondoDox, credential stealers and reverse shells observed in December 2025

6 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-55182, CVE-2024-4577, CVE-2023-1389 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

   React Server 19.2.0 - Remote Code Execution

   The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

   CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA
2. exploit-db.com · EDB-52331 ↗ · aplicação web · php · pub. 15/06/2025 não verificado

   PHP CGI Module 8.3.4 - Remote Code Execution (RCE)

   This script exploits CVE-2024-4577, an argument injection flaw in PHP running as CGI on Windows, where a soft hyphen in the query string is turned into a dash and lets the attacker pass configuration options to the interpreter. It needs only network access to an exposed php-cgi executable, with no login or user interaction. The options make PHP run code sent in the request body, giving command execution as the web server user. It looks like a working exploit with multi-host scanning and an interactive shell.

   CVE-2024-4577 · autor: İbrahimsql · explicação gerada por IA
3. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

   TP-Link Archer AX21 - Unauthenticated Command Injection

   This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

   CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA

1. exploit-db.com · EDB-50702 ↗ · aplicação web · php · pub. 02/02/2022 não verificado

   PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)

   This script exploits CVE-2017-9841: PHPUnit's eval-stdin helper, when left reachable in a web-exposed vendor directory, executes any PHP code sent in an HTTP request body. The attacker needs only network access to a site that deployed PHPUnit (a dev dependency) publicly, with no login or user interaction. The tool checks several common framework layouts with a harmless test, then offers an interactive prompt that runs system commands as the web server user. It is a simple, working exploit that matches the CVE.

   CVE-2017-9841 · autor: souzo · explicação gerada por IA
2. exploit-db.com · EDB-48333 ↗ · remoto · linux · pub. 16/04/2020 verificado

   ThinkPHP - Multiple PHP Injection RCEs (Metasploit)

   This Metasploit module exploits remote code execution in the ThinkPHP 5.x web framework through the public index page, where a crafted request makes the framework call a PHP function with attacker-chosen input. The attacker needs only network access to the web server, with no login or user interaction, and a ThinkPHP version up to 5.0.23. The module reads the version from an error page and picks one of two techniques, one per CVE. It runs system commands as the web server user and can drop a Linux payload for a remote session. It is a mature, working exploit.

   CVE-2019-9082 · autor: Metasploit · explicação gerada por IA
3. exploit-db.com · EDB-46488 ↗ · aplicação web · php · pub. 04/03/2019 não verificado

   zzzphp CMS 1.6.1 - Cross-Site Request Forgery

   This is a cross-site request forgery proof of concept against the zzzphp CMS 1.6.1 admin panel, in the template file editing function. The admin save form has no anti-CSRF token, so a malicious web page can silently submit a forged edit. The attacker only needs to lure a logged-in administrator to that page; no credentials or local access are required. The forged edit writes a PHP expression into a site template, which the CMS later evaluates, leading to remote code execution. It is a simple, working-looking PoC (unverified), and the author describes it as a follow-up to CVE-2019-9041.

   CVE-2019-9082 · autor: Yang Chenglong · explicação gerada por IA