CVE-2025-31097

Executive Summary

CVE-2025-31097 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Material Dashboard WordPress plugin by Hossein, up to and including version 1.4.5. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), and in some configurations, may be chained with file upload vulnerabilities to achieve Remote Code Execution (RCE). The CVSS score is 8.1 (High), and no official patch is currently available. This is a WordPress ecosystem issue; the vulnerable plugin is installed as a WordPress component.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is moderate, as the plugin is maintained by a third-party developer (Hossein) and no patch has been released. Users should monitor for updates and consider removing the plugin if it is not critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: None (I:N) – Cannot modify files directly.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the material-dashboard plugin's PHP code, likely in a file that handles template loading or includes. The plugin fails to sanitize user-supplied input used in a PHP include() or require() statement. An attacker can manipulate a parameter (e.g., page, file, template) to traverse directories and include arbitrary files.

Root Cause: The plugin uses user input directly in a file inclusion function without proper validation or sanitization. For example:

include($_GET['page'] . '.php');

An attacker can supply ../../../../etc/passwd%00 to null-terminate the string and include /etc/passwd.

Exploitation Scenario:

1. Attacker identifies a vulnerable parameter (e.g., page) in the plugin's URL.
2. Attacker sends a crafted request: http://target.com/wp-content/plugins/material-dashboard/vulnerable.php?page=../../../../etc/passwd%00
3. The server includes the /etc/passwd file, displaying its contents.

Impact:

• Disclosure of sensitive files (e.g., wp-config.php with database credentials).
• Potential for RCE if combined with file upload or log poisoning.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following:

Vulnerable Code (hypothetical):

<?php
$page = $_GET['page'];
include($page . '.php');
?>

Patched Code (recommended):

<?php
$allowed_pages = array('dashboard', 'settings', 'profile');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Handle error
    echo 'Invalid page.';
}
?>

Key Differences:

• The patched version uses a whitelist of allowed values.
• The vulnerable version directly uses user input without validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running WordPress with Material Dashboard plugin <= 1.4.5.
• A parameter that controls file inclusion (e.g., page, file, template).

Exploit Steps:

1. Identify the vulnerable endpoint. Common patterns: /wp-content/plugins/material-dashboard/ followed by a PHP file that accepts a page parameter.
2. Test for LFI using path traversal:

   http://target.com/wp-content/plugins/material-dashboard/some-file.php?page=../../../../etc/passwd%00
   

3. If successful, read sensitive files:
   • wp-config.php: page=../../../../wp-config.php%00
   • /etc/passwd: page=../../../../etc/passwd%00

Example cURL command:

curl -v 'http://target.com/wp-content/plugins/material-dashboard/vuln.php?page=../../../../etc/passwd%00'

Note: No public exploit code is available from Exploit-DB. The above is a generic LFI exploitation technique.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %00, ../../).
• Look for requests to plugin files with suspicious parameters.

Hardening:

• Remove or disable the plugin if not needed.
• Implement a Web Application Firewall (WAF) rule to block path traversal.
• Apply virtual patching: block requests containing ../ or %00 in plugin parameters.

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Simulate attacks using Burp Suite or custom scripts.
• Monitor logs with tools like ELK or Splunk.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or %00 in parameters targeting /wp-content/plugins/material-dashboard/.
• Repeated 200 responses with file contents (e.g., root:x:0:0:root).

File IOCs:

• Unexpected inclusion of system files in web responses.
• Modified plugin files (if attacker uploads a webshell).

Log IOCs:

• Apache/Nginx access logs showing:

  GET /wp-content/plugins/material-dashboard/vuln.php?page=../../../../etc/passwd%00 HTTP/1.1
  

• Error logs showing failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2025_31097_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Material Dashboard plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-31097"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%00/
        $plugin_path = /material-dashboard/
    condition:
        $plugin_path and $path_traversal
}

Sigma Rule

title: CVE-2025-31097 LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Material Dashboard plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%00'
        cs-uri-stem|contains: '/material-dashboard/'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31097 LFI Attempt"; flow:to_server,established; content:"/material-dashboard/"; http_uri; content:"../"; http_uri; distance:0; content:"%00"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: Deactivate and delete material-dashboard from WordPress admin.
2. Apply virtual patching via WAF: Block requests containing ../ or %00 in plugin parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (Hossein) must release a patched version that implements input validation (whitelist) and proper file path sanitization.
• Until a patch is available, consider replacing the plugin with an alternative.

Workaround:

• Modify the plugin code manually to add a whitelist (if you have developer access). This is not recommended for non-technical users.

Valters IT
Securing Digital Frontiers