thecyberfairy/cve-lfi-labA hands on lab investigating CVE-2025-39507 from a Tier 1 SOC analyst perspective. Includes log review in Microsoft Sentinel, IP analysis, real world screenshots, and a simple breakdown of a local file inclusion vulnerability in a WordPress plugin.
It’s a regular Monday. I’m logged into the SOC dashboard, reviewing alerts like usual. One comes in that catches my eye:
ALERT: Possible Local File Inclusion (LFI) Attempt
IP Address: 203.0.113.44
URL:/index.php?file=../../../../etc/passwd
User Agent: curl/7.81.0
It looks like someone might be trying to access system files by manipulating a URL. My job is to look into it and decide if this needs to be escalated.
After some quick research, I found this matches a known vulnerability: CVE-2025-39507. It affects a WordPress plugin called Nasa Core (version 6.3.2 and below). It allows attackers to view sensitive files on the server by changing a file input parameter.
Example:
/index.php?file=../../../../etc/passwd
If the plugin doesn’t validate the file input correctly, it’ll just follow whatever path the attacker gives it.
I didn’t write the detection rule, but I reviewed it to understand what triggered the alert. It looks for things like:
/etc/passwd or /wp-config.phpHere’s a simplified version of the rule:
CommonSecurityLog
| where RequestURL has "../"
or RequestURL has "etc/passwd"
or RequestURL has "wp-config"
| where DeviceCustomString1 contains "curl" or DeviceCustomString1 contains "python"
| project TimeGenerated, SourceIP, RequestURL, DeviceCustomString1
I ran a query to see if the IP 203.0.113.44 was trying anything else:
CommonSecurityLog
| where SourceIP == "203.0.113.44"
| summarize count() by RequestURL
Turns out, it also hit other paths like /admin/, /login.php, and /wp-config.php. That told me this wasn’t just a one time request... it was probably a scanner or someone doing recon.
I checked how long the IP had been active in our logs:
CommonSecurityLog
| where SourceIP == "203.0.113.44"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
It started a few hours ago and was still active recently. So it wasn’t historical noise — this was ongoing.
Here’s how I documented it for escalation:
“Possible LFI scan from IP 203.0.113.44. The request pattern matches CVE-2025-39507. IP accessed 9 unique paths including /etc/passwd and wp-config.php using curl. Behavior suggests automated recon. Recommend Tier 2 review and possible IP block.”
| # | Description | File |
|---|---|---|
| 1 | CVE Listing (Patchstack) | 1_cve_selection_listing.png |
| 2 | Patchstack Overview | 2_patchstack_cve_overview.png |
| 3 | VulDB Vector Example | 3_vuldb_exploit_vector.png |
| 4 | Azure Kali VM Created | 4_kali_vm_deployed.png |
| 5 | VM Running Screenshot | 5_kali_vm_running_status.png |
| 6 | SSH Access to Kali | 6_kali_vm_logged_in.png |
| 7 | Sentinel KQL Rule Review | 7_lfi_detection_kql_query.png |
All screenshots are located in the /screenshots folder.
Some questions I asked myself as I worked through this:
Next, I’ll run a safe simulation of this attack in a controlled lab environment using a platform like TryHackMe. The goal is to better understand what this type of activity looks like from the attacker’s side — and what kind of logs it creates.
P.S. This lab was done in a safe, ethical environment for training purposes only. No real systems were targeted or harmed. Always follow your organization’s rules and never test exploits on systems you don’t own or have permission to test.