CVE-2025-31340
Published: 17 April 2025
Summary
CVE-2025-31340 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-31340 is an improper control of filename for include/require statement vulnerability, categorized under CWE-98, that affects the retrieve course information function in Wisdom Master Pro versions 5.0 through 5.2. The flaw resides in PHP code that fails to properly sanitize filenames supplied to include or require statements, enabling execution of attacker-controlled files.
Remote attackers can exploit the issue without authentication or user interaction to run arbitrary system commands on the affected server by supplying a malicious file path. The vulnerability carries a CVSS 4.0 score of 9.9, reflecting network-accessible attack vectors with high impact on confidentiality, integrity, and availability.
An advisory describing the issue is available at https://zuso.ai/advisory/za-2025-03.
EPSS for the CVE rose from a low baseline to a peak of 0.0260, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11525
Vulnerability details
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.