ramzihafiz

GitHub · Repository owner · Source ID 43957229
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

ramzihafiz/CVE-2025-49132

Repository PoC1Created 2026-02-08ExploitCVE-2025-491322 files

2.8 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-49132 in Pterodactyl Panel to achieve unauthenticated remote code execution by writing a webshell and spawning a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The PoC script exploits CVE-2025-49132 to create a webshell and establish a reverse shell. All actions are consistent with the stated vulnerability and directed at a user-supplied target. No concealed backdoor, credential theft, persistence, or unrelated payload is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarePterodactyl Panel
Attack typesCode InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending malicious requests to write a webshell and execute a reverse shell, not merely detecting or reporting the issue.

CVE-2025-49132_POC.py:24-34

Requirements

  • Target Pterodactyl Panel version < 1.11.11CVE-2025-49132_POC.py:1
  • Attacker must set target host, listener IP, and port in the scriptCVE-2025-49132_POC.py:13-16
  • PEAR must be installed on the target at the specified pathCVE-2025-49132_POC.py:13

Observed behavior

  • Sends crafted HTTP requests to /locales/locale.json to write a base64-encoded PHP webshell to /tmp/payload.php using PEAR's config-createCVE-2025-49132_POC.py:24-25
  • Sends a second set of requests to decode the base64 payload into a webshell.php fileCVE-2025-49132_POC.py:30-31
  • Triggers the webshell to execute a bash reverse shell command, connecting back to the attacker's listenerCVE-2025-49132_POC.py:34
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell
Payload withheldThe script constructs a reverse shell command to a user-configured IP and port, which is the stated purpose of the PoC.CVE-2025-49132_POC.py:17
Webshell Creation
Payload withheldThe script creates a PHP webshell on the target to execute commands, which is a standard post-exploitation step for this CVE.CVE-2025-49132_POC.py:18-19
Target Configuration
Payload withheldThe target host is a placeholder that must be changed by the user, indicating the script does not contact a hardcoded attacker-controlled server.CVE-2025-49132_POC.py:16
Review boundaries

What the analysis did not establish

  • Evidence consists of complete source code and README; no runtime output or network captures are provided.
  • Only the two text files (CVE-2025-49132_POC.py and README.md) were reviewed; no binary or other files exist in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

ramzihafiz/cve-2024-30088-binary

Repository PoC1Created 2025-10-06Not analyzedCVE-2024-300881 file

13.5 KiB

GitHubPoC details