POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution Vulnerability
PreviousPOC - CVE-2025–2539 File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary FileNextGitHub Dorks
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
Read about it — CVE-2025-29306
Disclaimer: This Proof of Concept (POC) is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
To find potential targets, use Fofa (similar to Shodan.io):
Fofa Dork: (body="foxcms-logo" || body="foxcms-container") && body="div"
First, clone the repository:
git clone https://github.com/verylazytech/CVE-2025-29306Run the Exploit:
./CVE-2025-29306.sh <Target:port> <cmd>Learn & practice For the OSCP.
