CVE-2025-49113 PoC — Roundcube Webmail 安全漏洞

介绍

# CVE-2025-49113 Roundcube Exploit

A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization.

## Overview

This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It uses a crafted GPG configuration payload to achieve remote code execution on the target server.

## Features

- Automatic authentication with Roundcube
- CSRF token extraction and handling
- Session management
- PHP object deserialization payload generation
- Remote command execution via GPG configuration injection

## Usage

```bash
python exploit.py -t <target_url> -u <username> -p <password> -c <command>
```

### Parameters

- `-t, --target`: Target Roundcube base URL (e.g., `http://example.com/roundcube`)
- `-u, --user`: Valid username for authentication
- `-p, --password`: Password for the specified user
- `-c, --command`: Shell command to execute on the target server

### Example

```bash
python exploit.py -t http://target.com/roundcube -u [email] -p [password] -c "whoami"
```

## How It Works

1. **Authentication**: Logs into Roundcube using provided credentials
2. **Session Management**: Extracts and manages session cookies
3. **Payload Generation**: Creates a serialized PHP object containing the malicious GPG configuration
4. **File Upload**: Uploads a crafted image file with the payload as filename
5. **Code Execution**: The deserialization triggers command execution through GPG configuration

## Technical Details

The exploit targets the `Crypt_GPG_Engine` class deserialization vulnerability by:
- Crafting a base64-encoded shell command
- Embedding it in a serialized PHP object
- Using the object as a filename during file upload
- Triggering deserialization during file processing

## Disclaimer

This tool is for educational and authorized security testing purposes only. Only use this exploit on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.

## CVE Information

- **CVE ID**: CVE-2025-49113
- **Affected Software**: Roundcube Webmail
- **Vulnerability Type**: PHP Object Deserialization leading to RCE
- **Severity**: Critical

## License

This code is provided for educational purposes. Use responsibly and in accordance with applicable laws and regulations.

文件快照

备注