CVE-2025-49132-poc

I made this poc for CVE-2025-49132, as it was interesting to make and it's part of a challenge over at my cyber platform deepreview !

This CVE takes advantage of a file inclusion vulnerability that can be escalated to a Remote Code Execution with the pearcmd.php script. This is a cool technique, for a full explanation complete the challenge about this CVE on my website and read the solution page with all the technical details.

Usage :

python3 poc.py 127.0.0.1 'touch /tmp/omgitworks'

If it works correctly you should see an internal server error in the response. Also the payload breaks if you have + inside it. Installation path of the php binary might be modified, here I used the default path in containers but it might be different if installed on a full linux environment.

PS : hi ippsec ;)