CVE-2015-10141 Xdebug Remote Debugger Unauthenticated OS Command Execution
CriticalCVSS 9.3
EPSS 7.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/xdebug(Ubuntu:22.04) | All versions | No fix listed |
| debian/xdebug(Debian:12) | All versions | No fix listed |
| debian/xdebug(Debian:12) | = 3.2.0+3.1.6+2.9.8+2.8.1+2.5.5-3 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.0-1 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.0-2 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.0~alpha1-2~exp2 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.0~alpha1-2~exp3 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.0~alpha1-2~exp4 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.1-1 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.2-1 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.3-1 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.5-1 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.5-2 | No fix listed |
| debian/xdebug(Debian:12) | = 3.4.5-3 | No fix listed |
| debian/xdebug(Debian:13) | All versions | No fix listed |
| debian/xdebug(Debian:13) | = 3.4.5-3 | No fix listed |
| debian/xdebug(Debian:14) | All versions | No fix listed |
| debian/xdebug(Debian:14) | = 3.4.5-3 | No fix listed |
| Xdebug | <= 2.5.5 | No fix listed |
| ubuntu/xdebug(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/xdebug(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/xdebug(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2015-10141 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- xdebug.org product
- kirtixs.com technical-description
- web.archive.org technical-description
- www.exploit-db.com exploit
- www.fortiguard.com third-party-advisory
- www.vulncheck.com third-party-advisory