Exploit in template for CVE-2025-52970 is exploiting the wrong flaw (the same already present in another template - CVE-2025-25257)

CVE-2025-52970.yaml#L62

If we take a look at the code in this template, it's exploiting the SQL Injection in the Authorization header, which has been attributed CVE-2025-25257. The actualy exploit code is similar to the one shared by pwner.gg, who claims to be the co-author of the first CVE in

The same exact flaw is already exploited and tested in the correct template here: CVE-2025-25257.yaml , just not used to trigger RCE.

The actual exploit for CVE-2025-52970 should be interacting with a completely different component according to the author's write-up in: , in this case the APSCOOKIE_FWEB_ session cookie.