CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

CVSS

No CVSS.

References

Link	Resource
http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/
https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/
https://www.exploit-db.com/exploits/44568
https://www.fortiguard.com/encyclopedia/ips/46000
https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution
https://xdebug.org/

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de inyección de comandos no autenticados en Xdebug, una extensión de depuración de PHP desarrollada por Derick Rethans, en las versiones 2.5.5 y anteriores. Cuando la depuración remota está habilitada, Xdebug escucha en el puerto 9000 y acepta comandos del protocolo del depurador sin autenticación. Un atacante puede enviar un comando eval manipulado a través de esta interfaz para ejecutar código PHP arbitrario, que puede invocar funciones a nivel de sistema como system() o passthru(). Esto compromete completamente el host bajo los privilegios del usuario del servidor web.

23 Jul 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-23 14:15

Updated : 2026-04-15 00:35

NVD link : CVE-2015-10141

Mitre link : CVE-2015-10141

CVE.ORG link : CVE-2015-10141

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2015-10141", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-23T14:15:31.763", "references": [{"url": "http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/", "source": "disclosure@vulncheck.com"}, {"url": "https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/44568", "source": "disclosure@vulncheck.com"}, {"url": "https://www.fortiguard.com/encyclopedia/ips/46000", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution", "source": "disclosure@vulncheck.com"}, {"url": "https://xdebug.org/", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos no autenticados en Xdebug, una extensi\u00f3n de depuraci\u00f3n de PHP desarrollada por Derick Rethans, en las versiones 2.5.5 y anteriores. Cuando la depuraci\u00f3n remota est\u00e1 habilitada, Xdebug escucha en el puerto 9000 y acepta comandos del protocolo del depurador sin autenticaci\u00f3n. Un atacante puede enviar un comando eval manipulado a trav\u00e9s de esta interfaz para ejecutar c\u00f3digo PHP arbitrario, que puede invocar funciones a nivel de sistema como system() o passthru(). Esto compromete completamente el host bajo los privilegios del usuario del servidor web."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "disclosure@vulncheck.com"}