CVE-2015-10141 PoC — Xdebug Remote Debugger Unauthenticated OS Command Execution

Source

https://github.com/n0m4d22/PoC-CVE-2015-10141-Xdebug

Associated Vulnerability

Title: Xdebug Remote Debugger Unauthenticated OS Command Execution (CVE-2015-10141)
Description:An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

Description

Proof-of-Concept exploit script for Xdebug 2.5.5 and earlier versions (CVE-2015-10141).

Readme

# PoC-CVE-2015-10141

**Custom Python exploit for Xdebug ≤ 2.5.5 (CVE-2015-10141).**

---

## Description
This repository contains my **Proof-of-Concept (PoC) exploit** for the **Xdebug remote code execution vulnerability** in versions **2.5.5 and earlier**.  
The script leverages the **unauthenticated debugging protocol** exposed on port `9000` to achieve **remote command execution**.

- **Vulnerability**: [CVE-2015-10141](https://nvd.nist.gov/vuln/detail/CVE-2015-10141)  
- **Vulnerability type**: Remote Code Execution (RCE)  
- **Affected software**: Xdebug ≤ 2.5.5  

---

## Usage

```bash
git clone https://github.com/n0m4d22/PoC-CVE-2015-10141.git
cd PoC-CVE-2015-10141
python3 exploit.py
```

When prompted, enter the target IP where Xdebug is hosted.

Demonstration from my recent HackTheBox [Olympus](https://github.com/n0m4d22/HackTheBox-Writeups/blob/main/machines/medium/olympus/olympus-writeup.md) (Medium) write-up :

```bash
┌──(kali㉿kali)-[~]
└─$ python exploit.py
[*] Target IP: 10.129.124.136
[*] Connecting to 0.0.0.0:9000 ...
[*] Initializing debugging: curl http://10.129.124.136 -H "Cookie: XDEBUG_SESSION=olympus"
[*] Connection to ('10.129.124.136', 36354) established.
$ whoami
www-data
```

---

## Requirements
- Python 3.x
- Target running Xdebug ≤ 2.5.5 with remote debugging enabled

---

## Disclaimer

This project is created for educational purposes only.

**Do NOT** use this exploit against systems without explicit authorization. I am not responsible for any misuse of this code.

---

## References

- [NVD – CVE-2015-10141](https://nvd.nist.gov/vuln/detail/CVE-2015-10141)
- [ExploitDB – 44568](https://www.exploit-db.com/exploits/44568)
- [Xdebug Official Site](https://xdebug.org/)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →