Vulnerability Summary

• CVE ID: CVE-2025-49132
• CVSS Score: 10.0 (Critical)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
• Affected Versions: Pterodactyl Panel < 1.11.11
• Attack Complexity: Low
• Privileges Required: None (Unauthenticated)
• User Interaction: None

Vulnerability Details

What is PHP PEAR?

PHP PEAR (PHP Extension and Application Repository) is a framework and distribution system for reusable PHP components. It provides a command-line tool (pearcmd.php) that can be used to manage PEAR packages.

The pearcmd.php file processes commands through URL parameters, and when combined with path traversal, it can be leveraged to:

1. Create arbitrary PHP files on the system
2. Execute those files through the web server

Root Cause

The vulnerability exists because:

1. Unvalidated Path Traversal: The locale parameter in /locales/locale.json allows path traversal without proper validation
2. Direct File Inclusion: The application directly includes files based on user-controlled input
3. PEAR Command Injection: The pearcmd.php script accepts the +config-create command which can write arbitrary PHP files
4. Unauthenticated Access: The vulnerable endpoint doesn't require authentication

Attack Vector

An attacker can:

1. Use path traversal to reach the PEAR installation directory
2. Abuse the config-create command to write malicious PHP code to /tmp
3. Execute the malicious PHP file through the same endpoint
4. Achieve full remote code execution as the web server user

Technical Analysis

Exploitation Process

The exploit works in two stages:

Stage 1: Payload Creation

Breakdown:

• +config-create+/ - Invokes PEAR's config creation functionality
• locale=../../../../../../usr/share/php/PEAR - Path traversal to PEAR directory
• namespace=pearcmd - Targets the pearcmd.php file
• <?=system('id')?>+/tmp/payload.php - PHP payload and destination file

Stage 2: Payload Execution

Breakdown:

• locale=../../../../../../tmp - Path traversal to /tmp directory
• namespace=payload - Includes and executes payload.php

Why URL Encoding Breaks the Exploit

The exploit requires sending special characters (<, >, ?, =) in the URL without encoding them. If these characters are URL-encoded:

• <?=system('id')?> becomes %3C%3F%3Dsystem%28%27id%27%29%3F%3E
• PEAR interprets this as literal text instead of PHP code
• The PHP tags are not recognized, preventing code execution

Exploit Flow

Attack Flow Diagram

Installation

Prerequisites

• Python 3.6 or higher
• requests library

Clone the Repository

Install Dependencies

Or manually:

Usage

Basic Command Execution

Reverse Shell

Interactive Pseudo-Shell

Fuzz for PEAR Installations

Scan for Vulnerability

Checks for CVE-2025-49132 via config leaks (database credentials, app key).

Custom PEAR Path

Verbose Output

Shows detailed progress (payload creation, PEAR path, execution status).

Full Options

Examples

Example 1: Basic Command Execution

Use -v for verbose output (payload details, PEAR path, etc.).

Example 2: Reverse Shell

Example 3: Interactive Pseudo-Shell

Example 4: PEAR Path Fuzzing

Use -v to see per-path fuzz progress.

Example 5: Vulnerability Scanner

Mitigation

Immediate Actions

1. Update Pterodactyl Panel

   root@kitploit:~

   cd /var/www/pterodactyl
   php artisan p:upgrade
   

   Update to version 1.11.11 or later.

2. Disable Vulnerable Endpoint (Temporary Workaround)

   Add to your web server configuration:

   Apache (.htaccess):

   root@kitploit:~

   <Files "locale.json">
       Order Allow,Deny
       Deny from all
   </Files>
   

   Nginx:

   root@kitploit:~

   location ~* /locales/locale\.json {
       deny all;
       return 403;
   }
   

   Note: This will break localization features.

3. Web Application Firewall (WAF)

   Implement WAF rules to block path traversal attempts:

   root@kitploit:~

   SecRule REQUEST_URI "@contains ../" "id:1000,phase:1,deny,status:403"
   SecRule ARGS "@contains ../" "id:1001,phase:2,deny,status:403"
   

Long-term Solutions

1. Input Validation: Implement strict validation for the locale and namespace parameters
2. Path Sanitization: Use realpath() to resolve and validate file paths
3. Whitelist Approach: Only allow specific, predefined locale values
4. Authentication: Require authentication for locale endpoints
5. Security Audits: Regular security assessments and penetration testing

Detection

Log Analysis - Look for suspicious patterns:

IDS/IPS Signatures:

Disclaimer

FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY

This proof-of-concept exploit is provided for educational purposes and authorized security testing only. The author assumes no liability for misuse or damage caused by this program.

Legal Notice

• ✅ DO: Use this tool for authorized penetration testing and security research
• ✅ DO: Use this tool on systems you own or have explicit permission to test
• ✅ DO: Use this tool to verify patches and security controls
• ❌ DON'T: Use this tool against systems without explicit authorization
• ❌ DON'T: Use this tool for malicious purposes
• ❌ DON'T: Deploy this tool in production environments without proper controls

Unauthorized access to computer systems is illegal. Users are responsible for ensuring compliance with applicable laws and regulations.

References

• CVE-2025-49132 - NVD
• GitHub Advisory: GHSA-24wv-6c99-f843
• Pterodactyl Panel Security Advisory
• PHP PEAR Documentation
• CWE-94: Code Injection

Author

xffsec

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contributing

Contributions, issues, and feature requests are welcome! Feel free to open an issue or submit a pull request.

Acknowledgments

• Pterodactyl Panel development team for their responsible disclosure process
• The security research community
• HackTheBox for providing a safe environment to practice these techniques

⚠️ Remember: Always practice responsible disclosure and never exploit vulnerabilities without proper authorization.