CVE-2025-47572

Executive Summary

CVE-2025-47572 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Mojoomla School Management plugin, version 93.0.0 and earlier. This vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. The CVSS score of 7.5 (High) reflects the ease of exploitation and the potential for high confidentiality impact, as an attacker can read sensitive files such as configuration files containing database credentials, application source code, or system files like /etc/passwd. No public proof-of-concept (PoC) or exploit code has been identified at this time, but the vulnerability class is well-understood and easily weaponizable. The vendor has not released a patch, making this a high-priority risk for any site using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the Mojoomla ecosystem. As a third-party plugin, it introduces a supply chain risk: users who installed the plugin from the official Mojoomla source or other repositories are affected. No official patch or advisory has been released, and the plugin may be abandoned. Organizations should treat this as a critical supply chain issue and consider removing the plugin entirely.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full read access to arbitrary files.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Critical for any site using the plugin. The lack of a patch and the ease of exploitation make this a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) caused by improper sanitization of a filename parameter used in a PHP include() or require() statement. In the Mojoomla School Management plugin, a parameter (likely page, template, or similar) is passed to a PHP include function without proper validation or sanitization. An attacker can manipulate this parameter to include arbitrary files from the server.

Example vulnerable code pattern:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can use path traversal sequences (e.g., ../../../../etc/passwd%00) to escape the intended directory and include sensitive files. The null byte injection (%00) may be used to truncate the appended .php extension in older PHP versions, though modern PHP versions (5.3.4+) have fixed this. However, other techniques like using php://filter or absolute paths can still work.

Attack flow:

1. Attacker identifies the vulnerable parameter (e.g., ?file=...).
2. Attacker sends a request with a path traversal payload: ?file=../../../../etc/passwd.
3. The server includes the file, and its contents are displayed or processed.
4. Attacker can read configuration files (e.g., wp-config.php), source code, or system files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// In a file like school-management.php
$page = $_GET['page'];
include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');
?>

This code directly concatenates user input into the include path without sanitization.

Patched Code (Hypothetical):

<?php
$allowed_pages = array('dashboard', 'students', 'teachers');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');
} else {
    // Handle error
    wp_die('Invalid page.');
}
?>

A proper patch would use a whitelist of allowed values, or at minimum sanitize the input to remove path traversal characters and restrict to a specific directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a WordPress instance (e.g., using Docker: docker run --name wp -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress).
2. Download and install Mojoomla School Management plugin version 93.0.0 (if available) or a similar vulnerable version.
3. Activate the plugin.

Exploitation Steps:

1. Identify the vulnerable parameter. Common parameters in such plugins include page, template, file, include, load.
2. Test with a simple path traversal:

   http://target/wp-content/plugins/school-management/some-file.php?page=../../../etc/passwd
   

3. If the .php extension is appended, try null byte injection (for older PHP):

   http://target/...?page=../../../etc/passwd%00
   

4. Use PHP wrappers to read source code:

   http://target/...?page=php://filter/convert.base64-encode/resource=../../../wp-config.php
   

5. Decode the base64 output to reveal the file contents.

Automated Scanning: Use a tool like wfuzz or ffuf to fuzz for the vulnerable parameter:

ffuf -u http://target/FUZZ?page=../../../etc/passwd -w /usr/share/wordlists/parameters.txt -fc 404

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f, %252e%252e%252f).
• Look for requests to plugin files with suspicious parameters.
• Use WAF rules to block path traversal attempts.

Hunting:

• Search for requests containing page=, file=, template= with directory traversal sequences.
• Check for base64-encoded payloads in parameters (e.g., php://filter).

Mitigation:

• Immediately disable or remove the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.
• Restrict file inclusion to a whitelist of allowed files.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..%2f in parameters.
  • Requests to plugin files with parameters like page=, file=, template=.
  • Base64-encoded payloads in parameters (e.g., php://filter/convert.base64-encode/resource=).
  • User-Agent strings from known scanning tools (e.g., ffuf, wfuzz, sqlmap).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, wp-config.php, or other sensitive files.
  • Presence of webshells or backdoors in the plugin directory.

• Log IOCs:

  • Web server logs showing 200 responses to path traversal requests.
  • PHP error logs showing failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2025_47572_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Mojoomla School Management plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47572"
    strings:
        $path_traversal1 = "../"
        $path_traversal2 = "..\\"
        $path_traversal3 = "%2e%2e%2f"
        $path_traversal4 = "%252e%252e%252f"
        $php_wrapper = "php://filter"
        $sensitive_file1 = "/etc/passwd"
        $sensitive_file2 = "wp-config.php"
    condition:
        any of ($path_traversal*) or any of ($php_wrapper) or any of ($sensitive_file*)
}

Sigma Rule

title: CVE-2025-47572 LFI Attempt Against Mojoomla School Management
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting the vulnerable plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
            - 'php://filter'
            - '/etc/passwd'
            - 'wp-config.php'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47572 LFI Attempt - Mojoomla School Management"; flow:to_server,established; content:"../"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-47572 LFI Attempt - PHP Wrapper"; flow:to_server,established; content:"php://filter"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-47572 LFI Attempt - Sensitive File"; flow:to_server,established; content:"/etc/passwd"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Mojoomla School Management plugin from all WordPress installations.
2. Scan for compromise: Check for unauthorized file access, webshells, or backdoors in the web root.
3. Rotate credentials: If wp-config.php or other sensitive files were exposed, rotate all database passwords, API keys, and admin credentials.

Long-Term Mitigation:

• Patch: Monitor the Mojoomla vendor for an official patch. If none is released, consider migrating to an alternative school management plugin.
• WAF Rules: Implement virtual patching via a WAF (e.g., ModSecurity, Cloudflare) to block LFI patterns.
• Code Review: If you must keep the plugin, perform a manual code review and apply a whitelist-based fix as shown in the patched code example.
• Least Privilege: Ensure the web server runs with minimal file system permissions to limit the impact of LFI.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or support, contact: threatintel@valters-it.com