Exploit for CVE-2025-30208

## https://sploitus.com/exploit?id=1B24FF1F-F057-5495-A780-3CD8409E5B1F
## CVE-2025-30208-EXP

A vulnerability in Vite’s server’s arbitrary file reading mechanism (CVE-2025-30208). The vulnerability has a wide scope, is easy to exploit, and poses significant risks! Fofa mapping statements:

```
body="/@vite/client"
```

Hunter mapping statement:

```
web.body="/@vite/client"
```

## How to use the Exp script

```
-u for detection
```

```
-p to specify the payload path, e.g. /etc/passwd
```

```
-d to use a dictionary for fuzz testing
```

### Use this Exp script without a proxy

```
python3 Vite-CVE-2025-30208-EXP.py -f ip.txt
```

### Use this Exp script with an HTTP proxy

```
python3 Vite-CVE-2025-30208-EXP.py -f ip.txt --proxy http://127.0.0.1:8080
```

**Note! This project is not a Poc. Please use it under the condition that you comply with the disclaimer.**

This project will attempt to detect whether there are any arbitrary files for reading in the `/etc/passwd` file. You can use `-p` to specify the path of the desired file to read, and `-d` to specify the fuzz dictionary.

If you find it useful, please give me a Star 😋

The scan results, including the accounts and passwords found, will be saved in `output.txt`. The `IP.txt` format is `http://[ip]/[domain]`, one line per IP address.

## Disclaimer

1. If you download, install, use, or modify this tool and its related code, you are deemed to trust this tool.
2. We will not assume any responsibility for any losses or damages caused to yourself or others during the use of this tool.
3. If you engage in any illegal activities while using this tool, you will bear the corresponding consequences yourself. We will not assume any legal or joint liability.
4. Please carefully read and fully understand the terms and conditions, especially those regarding exemptions or limitations on liability. Choose to accept or reject them.
5. You are not entitled to download, install, or use this tool unless you have read and accepted all terms of this agreement.
6. Your actions of downloading, installing, or using this tool are considered as your acceptance of the above terms.