CVE-2025-30208-EXP

CVE-2025-30208-EXP

Vite development server arbitrary file read vulnerability (CVE-2025-30208), with wide coverage, simple exploitation, and no restrictions, posing a huge threat!

Fofa search syntax:

body="/@vite/client"

Hunter search syntax:

web.body="/@vite/client"

Exp script usage

-u  to check

-p  custom payload e.g. /etc/passwd

-d  use a wordlist for fuzz testing

Use this Exp without proxy

python3 Vite-CVE-2025-30208-EXP.py -f ip.txt

Use this Exp with HTTP proxy

python3 Vite-CVE-2025-30208-EXP.py -f ip.txt --proxy http://127.0.0.1:8080

Note! This project is not a PoC, please use it under the terms of the disclaimer!

This project will attempt to detect arbitrary file read against the target's /etc/passwd. You can use -p to specify a desired file path, and -d to specify a desired fuzz wordlist.

If you like it, feel free to give me a Star😋

Scan results that match accounts and passwords will be saved in output.txt. The IP.txt format is http://[ip]/[domain], one per line.

Disclaimer

1. If you download, install, use, or modify this tool and related code, you are deemed to have trusted this tool.
2. We shall not be liable for any loss or damage of any kind caused to you or others by the use of this tool.
3. If you engage in any illegal activity while using this tool, you shall bear the corresponding consequences. We shall not assume any legal or joint liability.
4. Please read and fully understand each clause carefully, especially those regarding exemption or limitation of liability, and choose to accept or not.
5. Unless you have read and accepted all terms of this agreement, you are not authorized to download, install, or use this tool.
6. Your downloading, installing, or using this tool constitutes your acceptance of the above agreement.