pip install requests

# Clone or download the scanner
curl -O https://your-host/cve_2024_40725_scanner.py

# Make executable (optional)
chmod +x cve_2024_40725_scanner.py

python3 cve_2024_40725_scanner.py --target <URL> [OPTIONS]

# Quickstart: scan localhost with built-in default paths
python3 cve_2024_40725_scanner.py --target http://localhost

# Scan specific paths
python3 cve_2024_40725_scanner.py \
  --target http://192.168.1.10 \
  --paths /index.php /admin/config.php /wp-config.php

# Use a wordlist file
python3 cve_2024_40725_scanner.py \
  --target http://192.168.1.10 \
  --wordlist php_paths.txt

# Combine wordlist + extra inline paths (merged, deduplicated)
python3 cve_2024_40725_scanner.py \
  --target http://192.168.1.10 \
  --wordlist php_paths.txt \
  --paths /extra/secret.php

# HTTPS with self-signed certificate
python3 cve_2024_40725_scanner.py \
  --target https://myserver.local \
  --no-verify-ssl

# Polite scan with 1 second delay and JSON report
python3 cve_2024_40725_scanner.py \
  --target http://myserver.local \
  --wordlist php_paths.txt \
  --delay 1.0 \
  --output results.json \
  --verbose

# CI/CD usage (exit code 1 = vulnerable, 0 = clean)
python3 cve_2024_40725_scanner.py --target http://localhost || echo "VULNERABLE"

# Common PHP entrypoints
/index.php
/info.php
/phpinfo.php

# Admin panels
/admin/index.php
/admin/config.php

# CMS files
/wp-config.php
/wp-login.php
/configuration.php

# API internals
/api/v1/status.php

GET /index.php HTTP/1.1

GET / HTTP/1.1

============================================================
  CVE-2024-40725 -- Apache Source Code Disclosure Scanner
============================================================
  Target : http://localhost
  Paths  : 6
  Time   : 2024-08-01T12:00:00

  [*] Fingerprinting server: http://localhost
      Server Header : Apache/2.4.61 (Debian)
      Apache Version: 2.4.61
      [!] Version is in vulnerable range (2.4.0 - 2.4.61)

  [*] Testing 6 path(s)...

  --- /index.php
      Direct  (HTTP 200): OK
      Subreq  (HTTP 200): LEAKED
      [!] VULNERABLE via: subrequest (directory index)
         Leaked snippet: '<?php\n$db_pass = "supersecretpassword";'

  --- /info.php
      Direct  (HTTP 404): OK
      Subreq  (HTTP 404): OK
      [+] Safe

============================================================
  SCAN SUMMARY
============================================================
  Target            : http://localhost
  Apache Version    : 2.4.61
  Paths Tested      : 6
  Vulnerable Paths  : 1
  Safe Paths        : 5

  [!] RESULT: VULNERABLE
      Vulnerable paths:
        * /index.php  (trigger: subrequest (directory index))

  Remediation:
    1. Upgrade to Apache httpd >= 2.4.62
    2. Replace 'AddType' with 'SetHandler' in <FilesMatch> blocks
============================================================

{
  "target": "http://localhost",
  "scan_time": "2024-08-01T12:00:00",
  "apache_version": "2.4.61",
  "apache_in_range": true,
  "paths_tested": 6,
  "vulnerable_paths": [
    {
      "path": "/index.php",
      "direct_url": "http://localhost/index.php",
      "directory_url": "http://localhost/",
      "direct_status": 200,
      "direct_leaked": false,
      "direct_snippet": null,
      "directory_status": 200,
      "directory_leaked": true,
      "directory_snippet": "<?php\n$db_pass = \"supersecretpassword\";",
      "server_header": "Apache/2.4.61 (Debian)",
      "vulnerable": true,
      "trigger": "subrequest (directory index)"
    }
  ],
  "safe_paths": [...]
}

# Debian / Ubuntu
sudo apt update && sudo apt install apache2

# RHEL / CentOS / AlmaLinux
sudo dnf update httpd

# Verify version (must be >= 2.4.62)
apache2 -v

# ❌ Vulnerable Configs
AddType application/x-httpd-php .php

# ✅ Safe Configs
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
</FilesMatch>

# VULNERABLE
<VirtualHost *:80>
    DocumentRoot /var/www/html
    AddType application/x-httpd-php .php     # ← triggers CVE
    DirectoryIndex index.php
</VirtualHost>

# SAFE
<VirtualHost *:80>
    DocumentRoot /var/www/html
    <FilesMatch "\.php$">
        SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
    </FilesMatch>
    DirectoryIndex index.php
</VirtualHost>