Campcodes School Faculty Scheduling System admin/index.php file inclusion

#!/usr/bin/env bash
# check-cve-2025-0211.sh
# Detects the vulnerable include pattern for CVE-2025-0211 in Campcodes School Faculty Scheduling System.
# Usage: bash check-cve-2025-0211.sh /path/to/app
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

set -u

APP_ROOT="${1:-}"
if [[ -z "$APP_ROOT" ]]; then
  echo "UNKNOWN: missing application path argument"
  exit 2
fi

TARGET="$APP_ROOT/admin/index.php"
if [[ ! -f "$TARGET" ]]; then
  echo "UNKNOWN: file not found: $TARGET"
  exit 2
fi

# Normalize line endings for matching.
CONTENT="$(tr -d '\r' < "$TARGET")"

# Strong indicator from the published PoC.
HAS_PAGE_ASSIGN=0
HAS_UNSAFE_INCLUDE=0
HAS_ALLOWLIST_HINT=0

if printf '%s' "$CONTENT" | grep -Eq "\$page *= *isset\(\$_GET\['page'\]\) *\? *\$_GET\['page'\] *: *'home'"; then
  HAS_PAGE_ASSIGN=1
fi

if printf '%s' "$CONTENT" | grep -Eq "include[[:space:]]+\$page[[:space:]]*\.[[:space:]]*'\.php'"; then
  HAS_UNSAFE_INCLUDE=1
fi

# Simple signs of local hardening.
if printf '%s' "$CONTENT" | grep -Eqi "in_array\(|switch[[:space:]]*\(|case[[:space:]]+'|preg_match\(|realpath\(|basename\("; then
  HAS_ALLOWLIST_HINT=1
fi

if [[ $HAS_PAGE_ASSIGN -eq 1 && $HAS_UNSAFE_INCLUDE -eq 1 ]]; then
  echo "VULNERABLE: unsafe user-controlled include pattern present in $TARGET"
  exit 1
fi

if [[ $HAS_ALLOWLIST_HINT -eq 1 ]]; then
  echo "PATCHED: unsafe include pattern not found and hardening indicators are present in $TARGET"
  exit 0
fi

if printf '%s' "$CONTENT" | grep -Eq "\$_GET\['page'\]|\$_REQUEST\['page'\]"; then
  echo "UNKNOWN: page parameter handling exists, but the exact published vulnerable pattern was not matched"
  exit 2
fi

echo "PATCHED: published vulnerable include pattern not found in $TARGET"
exit 0