CVE-2015-10141
CRITICAL NUCLEIXdebug < 2.5.5 - Unauthenticated OS Command Injection via Remote Debugger Interface
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2015-10141.
PoCs published by Metasploit, D3Ext, n0m4d22, including Metasploit module exploits/unix/http/xdebug_unauth_exec.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in Xdebug versions 2.5.5 and below, allowing unauthenticated OS command execution via the eval command. It establishes a reverse shell by leveraging the Xdebug debugger session.
Description
An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.
Exploits (4)
This Metasploit module exploits a vulnerability in Xdebug versions 2.5.5 and below, allowing unauthenticated OS command execution via the eval command. It establishes a reverse shell by leveraging the Xdebug debugger session.
This is a functional exploit for CVE-2015-10141, targeting Xdebug v2.5.5 and earlier. It leverages unauthenticated command execution via the Xdebug debugger interface on port 9000, allowing arbitrary PHP code execution.
This is a functional Python exploit for CVE-2015-10141, targeting Xdebug ≤ 2.5.5. It leverages the unauthenticated debugging protocol on port 9000 to achieve remote command execution via base64-encoded PHP system() calls.
This Metasploit module exploits a vulnerability in Xdebug versions 2.5.5 and below, allowing unauthenticated remote command execution via the eval command. It sets up a TCP server to deliver a base64-encoded PHP payload to the target.
Nuclei Templates (1)
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N