CVE-2025-49132 PoC — Pterodactyl Panel 代码注入漏洞

介绍

# CVE-2025-49132-poc

I made this poc for [CVE-2025-49132](https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843), as it was interesting to make and it's part of a challenge over at my cyber platform [deepreview](https://deepreview.app) !

This is all explained in a blog post I made and in the challenge over at the website !

This CVE takes advantage of a file inclusion vulnerability that can be escalated to a Remote Code Execution with the `pearcmd.php` script.

Usage :
```shell
python3 poc.py 127.0.0.1 'touch /tmp/omgitworks'
```

If it works correctly you should see an internal server error in the response.

文件快照

备注