CVE-2025-31324 PoC — Missing Authorization check in SAP NetWeaver (Visual Composer development server)

Source

https://github.com/moften/CVE-2025-31324

Associated Vulnerability

Title:Missing Authorization check in SAP NetWeaver (Visual Composer development server) (CVE-2025-31324)
Description:SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Description

SAP PoC para CVE-2025-31324

Readme

# PoC - CVE-2025-31324
# m10sec@proton.me

Exploit de prueba para la vulnerabilidad **CVE-2025-31324** en **SAP NetWeaver Visual Composer**, que permite la **carga arbitraria de archivos sin autenticación** a través del endpoint `/developmentserver/metadatauploader`.

> ⚠️ Este código es solo para fines educativos y pruebas autorizadas. No lo utilices en entornos de producción ni contra sistemas sin permiso.

## Descripción

La vulnerabilidad permite a un atacante remoto no autenticado subir archivos arbitrarios al servidor SAP, lo que podría derivar en ejecución remota de código (RCE) si se suben archivos ejecutables.

## Uso

```bash
python3 CVE-2025-31324.py <URL objetivo> <archivo a subir>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!