Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-49132 — This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical vulnerability in Pterodactyl Panel versions < 1.11.11. | Kitploit
Tools/GitHubGitHub/str1keboo/cve-2025-49132
Vulnerability AnalysisExploitationWeb Application ExploitationCTFPenetration TestingLearning & Education
GitHubstr1keboo/cve-2025-49132

CVE-2025-49132

This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical vulnerability in Pterodactyl Panel versions < 1.11.11.

View Repository
317 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-49132 Proof of Concept (PoC)

This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical unauthenticated remote code execution (RCE) vulnerability in Pterodactyl Panel versions prior to 1.11.11.

Vulnerability Details

  • CVE ID: CVE-2025-49132
  • Severity: 10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Affected Versions: < 1.11.11 (e.g., 1.9.0 to 1.11.10)
  • Description: An unauthenticated arbitrary remote code execution vulnerability exists in the Pterodactyl Panel through the /locales/locale.json endpoint, exploitable via the locale and namespace query parameters. This allows attackers to execute arbitrary code, read sensitive files (e.g., configs, .env), dump databases, and access managed servers.
  • Advisory: GitHub Security Advisory GHSA-24wv-6c99-f843
  • Patch: Fixed in v1.11.11. Apply the patch from commit 24c82b0 or upgrade immediately.
  • Workarounds: Use an external WAF (e.g., Cloudflare). No software workaround; disable the endpoint at web server level if feasible (breaks localization).

PoC Script

The script CVE-2025-49132-PoC.py is an automated tool that can:

  • Test if a target is vulnerable (checks for path traversal to config files).
  • Exploit for limited RCE (sleep 5 seconds as demonstration; requires PEAR installed).
  • Dump database credentials (from config/database).

It supports both Linux and Windows targets by adjusting path separators. Includes colored output and error handling for better usability.

Usage

root@kitploit:~
python CVE-2025-49132-PoC.py <mode> <http://host> [--os <linux|windows>] [--traversal-level <int>]

#Example of commands

root@kitploit:~
python CVE-2025-49132-PoC.py test http://sub.domain.com
python CVE-2025-49132-PoC.py dump http://domain.com
python CVE-2025-49132-PoC.py exploit http://sub.domain.com --os linux
python CVE-2025-49132-PoC.py test http://sub.domain.com --os linux --traversal-level 3

If the check fails, review the printed URL, status, and response. The response may be HTML if the endpoint is blocked or not vulnerable. Ensure the host is correct and reachable.

Modes:

  • test: Check vulnerability.
  • exploit: Perform RCE (sleep 5 seconds as PoC).
  • dump: Dump credentials.
  • --os: linux (default) or windows
  • --traversal-level: Number of '../' (default 3 for config/dump, 5 for RCE). Adjust if paths differ (e.g., 4 or 6).

OpSec Considerations

  • RCE exploitation can be detected via logs: cat /var/www/pterodactyl/storage/logs/laravel-2025--.log | grep 'Illuminate\Translation\FileLoader->load()'
  • If access logs are enabled, look for locale=.. entries.
  • Default config (without SSL) may not log credentials easily.

Legal Disclaimer

This PoC is provided for educational purposes only or for use in authorized challenges such as CTFs (Capture The Flag) or penetration testing with explicit permission. It is illegal to use this against any system without prior written consent from the owner. The author assumes no liability for any misuse of this code.

Installation

Requires Python 3 and requests (install via pip install requests).

Dependencies

  • requests (pip install requests)
  • colorama (pip install colorama)
  • urllib3 (pip install urllib3)
  • argparse (standard library)

License

MIT License. See LICENSE file.

Contributing

Pull requests are welcome for improvements, but ensure they align with educational intent.

Download Tool