CVE-2025-64284

Executive Summary

CVE-2025-64284 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Majestic Support plugin (versions <= 1.0.7). This vulnerability allows an unauthenticated attacker to include arbitrary local files on the server, potentially leading to sensitive information disclosure, source code leakage, or further exploitation. The vulnerability stems from improper control of filenames used in PHP include/require statements, specifically enabling PHP Local File Inclusion. The CVSS score is 7.5 (High), and no patch is currently available. This issue is specific to the WordPress ecosystem and affects the Majestic Support plugin.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a WordPress plugin vulnerability. The Majestic Support plugin is distributed through the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any site using the affected plugin.

Deep Dive & Mechanics

The vulnerability exists in the Majestic Support plugin's handling of include/require statements. The plugin fails to properly sanitize or validate user-supplied input used in PHP's include() or require() functions. An attacker can manipulate the filename parameter to traverse directories and include arbitrary files from the server's filesystem.

Root Cause: The plugin uses user input directly in a PHP include statement without proper validation or sanitization. For example, a vulnerable code snippet might look like:

include($_GET['file'] . '.php');

This allows an attacker to use path traversal sequences (e.g., ../../etc/passwd) to include sensitive files.

Impact:

• Information Disclosure: Attackers can read sensitive files like /etc/passwd, configuration files, or database credentials.
• Source Code Leakage: PHP files can be read as plaintext, revealing application logic and potential further vulnerabilities.
• Potential RCE: If the attacker can upload a malicious file (e.g., via another vulnerability) and then include it, they could achieve remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.7):

<?php
$file = $_GET['file'];
include($file . '.php');
?>

Patched Code (Hypothetical):

<?php
$allowed_files = array('dashboard', 'tickets', 'settings');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include($file . '.php');
} else {
    // Handle error
}
?>

The patched version uses a whitelist approach to restrict which files can be included, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with Majestic Support plugin version <= 1.0.7 installed.
• Knowledge of the vulnerable endpoint (e.g., /wp-content/plugins/majestic-support/includes/).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., file).
2. Craft a payload to read sensitive files:

   http://target.com/wp-content/plugins/majestic-support/includes/index.php?file=../../../../etc/passwd
   

3. Observe the response for file contents.

Example Payload:

GET /wp-content/plugins/majestic-support/includes/index.php?file=../../../../etc/passwd HTTP/1.1
Host: target.com

Blue Team

Detection:

• Monitor web server logs for suspicious path traversal patterns (e.g., ../ sequences).
• Look for requests to the Majestic Support plugin directory with unusual parameters.
• Use WAF rules to block path traversal attempts.

Hunting:

• Search for log entries containing file=.. or %2e%2e%2f.
• Check for unexpected file reads in application logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing file=../../ or similar path traversal patterns.
  • Requests to /wp-content/plugins/majestic-support/ with suspicious parameters.
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or other sensitive files.
  • Presence of log entries showing file inclusion attempts.
• Log IOCs:
  • Web server logs showing GET /wp-content/plugins/majestic-support/includes/index.php?file=../../etc/passwd.

Detection Engineering

YARA Rule

rule CVE_2025_64284_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Majestic Support plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64284"
    strings:
        $path_traversal = /file=\.\.(\/|\\)[^&]*/
        $plugin_path = /wp-content\/plugins\/majestic-support/
    condition:
        $plugin_path and $path_traversal
}

Sigma Rule

title: CVE-2025-64284 LFI Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Majestic Support plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'file=../'
            - 'file=..%2f'
            - 'file=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of file parameter with valid paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64284 LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/majestic-support/"; http_uri; content:"file="; http_uri; pcre:"/file=\.\.(\/|%2f)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement WAF rules to block path traversal patterns.
3. Restrict file permissions on sensitive system files.

Long-term Fix:

• Apply a whitelist-based approach for file inclusion.
• Use realpath() to resolve and validate file paths.
• Update to a patched version when released.

Workarounds:

• Use .htaccess to block direct access to the vulnerable directory:

  <FilesMatch "index\.php$">
      Order Allow,Deny
      Deny from all
  </FilesMatch>
  

• Monitor for plugin updates from the vendor.

Valters IT
Securing Digital Frontiers