CVE-2025-0632

Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise. This issue affects Rock Maker Web: from 3.2.1.1 and later

CVSS

No CVSS.

References

Link	Resource
https://formulatrix.com/downloads/apps/repository/rockmaker/RockMaker%20V3/3.18/3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe
https://formulatrix.com/downloads/docs/cve/RockMaker/CVE-2025-0632_Security_Bulletin.pdf
https://www.formulatrix.com/downloads/apps/repository/rockmaker/

Configurations

No configuration.

History

28 Apr 2025, 03:15

Type	Values Removed	Values Added
References		() https://formulatrix.com/downloads/apps/repository/rockmaker/RockMaker%20V3/3.18/3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe - () https://formulatrix.com/downloads/docs/cve/RockMaker/CVE-2025-0632_Security_Bulletin.pdf -
Summary		(es) La vulnerabilidad de inclusión de archivos locales (LFI) en Render function of Formulatrix Rock Maker Web (RMW) permite que un atacante remoto obtenga datos confidenciales a través de la ejecución de código arbitrario. Un atacante podría ejecutar scripts maliciosos para descargar automáticamente archivos de configuración en ubicaciones conocidas y así exfiltrar datos, incluidas las credenciales. Sin límite de velocidad, podría enumerar el sistema de archivos del host y potencialmente comprometer completamente el host. Este problema afecta a Rock Maker Web desde la versión 3.2.1.1 y posteriores.

21 Apr 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-21 06:15

Updated : 2025-04-28 03:15

NVD link : CVE-2025-0632

Mitre link : CVE-2025-0632

CVE.ORG link : CVE-2025-0632

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

{"id": "CVE-2025-0632", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-21T06:15:44.043", "references": [{"url": "https://formulatrix.com/downloads/apps/repository/rockmaker/RockMaker%20V3/3.18/3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://formulatrix.com/downloads/docs/cve/RockMaker/CVE-2025-0632_Security_Bulletin.pdf", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://www.formulatrix.com/downloads/apps/repository/rockmaker/", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-98"}]}], "descriptions": [{"lang": "en", "value": "Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution.\u00a0A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later"}, {"lang": "es", "value": "La vulnerabilidad de inclusi\u00f3n de archivos locales (LFI) en Render function of Formulatrix Rock Maker Web (RMW) permite que un atacante remoto obtenga datos confidenciales a trav\u00e9s de la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante podr\u00eda ejecutar scripts maliciosos para descargar autom\u00e1ticamente archivos de configuraci\u00f3n en ubicaciones conocidas y as\u00ed exfiltrar datos, incluidas las credenciales. Sin l\u00edmite de velocidad, podr\u00eda enumerar el sistema de archivos del host y potencialmente comprometer completamente el host. Este problema afecta a Rock Maker Web desde la versi\u00f3n 3.2.1.1 y posteriores."}], "lastModified": "2025-04-28T03:15:18.253", "sourceIdentifier": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}