Exploit for OS Command Injection in Devcode Openstamanager

CVE-2025-69212

githubexploit · 2026-06-29

Description

Exploit for operating system command injection in Devcode Openstamanager.

Entry point

Parameterfilename inside ZIP (malicious) · request body

Pathplugins/importFE_ZIP/actions.php

OS Command Injection via P7M file processing when a ZIP containing a crafted .p7m filename is uploaded.

Affected Devcode Openstamanager versions

Devcode Openstamanager≤ 2.9.8

All known vulnerabilities by product

Fatturaelettronica Openstamanager Importfe Zip

CVSS 9.4 for CVE-2025-69212

9.4

HIGH SEVERITY

Version 4.0

VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:LOW

User Interaction:NONE

Working code

99%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

1.8%higher than 76.0% of all CVEs

Updated 2026-08-17

Exploit Details

Modified:2026-06-29 08:48

Last Seen:2026-06-29 08:52

Reporter:w3nch

Written in:Python

Last commit:2026-06-29

Other exploits for CVE-2025-69212

Exploit for OS Command Injection in Devcode Openstamanager

2026-08-14 lolw0GITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-07-12 mmoobbeeiidat-designGITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-07-03 0Zetrium0GITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-07-01 alaeddine03GITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-07-01 m2sousaGITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-06-30 xoranddGITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-06-30 BridgerAldersonGITHUB

Exploit for OS Command Injection in Devcode Openstamanager

2026-06-28 TheAlc0h0l1cGITHUB

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=A845412F-BD57-5D6D-BCC4-A8A7B178068A
No description provided

Exploit Code

Share

Share on social media: