CVE-2025-34045
📋 TL;DR
A path traversal vulnerability in WeiPHP 5.0 allows unauthenticated remote attackers to read arbitrary files on the server by sending crafted POST requests to the /public/index.php/material/Material/_download_imgage endpoint. This exposes sensitive information including configuration files and source code. All deployments of WeiPHP 5.0 are affected.
💻 Affected Systems
- WeiPHP
📦 What is this software?
Weiphp by Weiphp
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files containing database credentials, API keys, or other secrets that could lead to further attacks.
Likely Case
Exposure of sensitive configuration files, source code, and potentially user data stored in accessible files.
If Mitigated
Limited impact if proper input validation and file access controls are implemented, restricting access to sensitive directories.
🎯 Exploit Status
Exploitation evidence was observed by Shadowserver Foundation on 2025-02-05 UTC. The vulnerability requires only crafted HTTP POST requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.cnvd.org.cn/flaw/show/CNVD-2020-68596
Restart Required: No
Instructions:
No official patch is available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation on the picUrl parameter to prevent directory traversal sequences.
Modify /public/index.php/material/Material/_download_imgage endpoint to validate and sanitize picUrl parameter
Web Application Firewall (WAF)
allDeploy a WAF with rules to block path traversal patterns in HTTP requests.
Configure WAF to block requests containing '../', '..\', or similar traversal patterns
🧯 If You Can't Patch
- Restrict network access to the WeiPHP application using firewall rules to only trusted IP addresses.
- Move sensitive configuration files outside the web-accessible directory structure.
🔍 How to Verify
Check if Vulnerable:
Send a POST request to /public/index.php/material/Material/_download_imgage with picUrl parameter containing traversal sequences like '../../../../etc/passwd' and check if file contents are returned.Check Version:
Check WeiPHP version in configuration files or admin interface; look for version 5.0 in the codebase.Verify Fix Applied:
Test the same exploitation attempt after implementing fixes; successful fixes should return error messages or empty responses instead of file contents.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /public/index.php/material/Material/_download_imgage with unusual picUrl parameters containing '../' sequences
- Access logs showing file reads from unexpected directories
Network Indicators:
- HTTP traffic patterns showing repeated POST requests with traversal sequences in parameters
SIEM Query:
source="web_logs" AND uri="/public/index.php/material/Material/_download_imgage" AND method="POST" AND (param="%2E%2E%2F" OR param="..%2F" OR param="..\\")