CVE-2025-41646 - RevPi Webstatus <= 2.4.5 Authentication Bypass Exploit

Overview

This is a Python3 exploit script for CVE-2025-41646, an Authentication Bypass vulnerability affecting RevPi Webstatus <= 2.4.5.

Vulnerability Details:

• CVE ID: CVE-2025-41646
• Affected Product: RevPi Webstatus <= 2.4.5
• Impact: Remote attackers can bypass authentication and obtain a valid admin session ID.
• Vulnerability Type: Authentication Bypass
• Attack Vector: Remote HTTP POST request to /php/dal.php

Features

• Supports single target or mass exploitation via target list
• Proxy support (e.g., Burp Suite)
• Silent mode (prints session ID only)
• JSON output option
• Stores valid session IDs in an output file

Usage

Install requirements:

pip install -r requirements.txt

Requirements:

requests

urllib3 (usually comes with requests)

Command Examples:

Single Target Exploitation:

python3 cve_2025_41646_auth_bypass.py -u "http://192.168.1.100"

Multiple Targets (File List):

python3 cve_2025_41646_auth_bypass.py -l targets.txt

Use Proxy:

python3 cve_2025_41646_auth_bypass.py -u "http://192.168.1.100" --proxy "http://127.0.0.1:8080"

Silent Mode (Prints only Session ID):

python3 cve_2025_41646_auth_bypass.py -u "http://192.168.1.100" --silent

JSON Output:

python3 cve_2025_41646_auth_bypass.py -u "http://192.168.1.100" --json

Script Options

Output Example

request/response

⚠️ Disclaimer

This tool is for educational and authorized penetration testing purposes only. Unauthorized usage against systems without explicit permission is illegal.

Official Channels

• YouTube @rootctf
• X @r0otk3r