CVE-2025-41737
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to read PHP module source code due to webserver misconfiguration. It affects systems running vulnerable webserver configurations that expose PHP files. The impact is information disclosure of potentially sensitive server-side code.
💻 Affected Systems
- Web servers with PHP support (Apache, Nginx, IIS with PHP)
📦 What is this software?
Ewio2 Bm Firmware by Metz Connect
Ewio2 M Bm Firmware by Metz Connect
Ewio2 M Firmware by Metz Connect
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive application logic, database credentials, API keys, or other secrets embedded in PHP source code, leading to full system compromise.
Likely Case
Attackers read configuration files and application source code, enabling further attacks like SQL injection discovery or authentication bypass.
If Mitigated
Limited to reading non-sensitive PHP files with proper file permissions and directory restrictions in place.
🎯 Exploit Status
Simple HTTP requests to PHP files can reveal source code if misconfigured
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://certvde.com/de/advisories/VDE-2025-097
Restart Required: No
Instructions:
1. Review webserver configuration 2. Ensure PHP files are processed by PHP interpreter 3. Remove any .htaccess or configuration that serves PHP as text 4. Test with sample PHP file access
🔧 Temporary Workarounds
Apache .htaccess Restriction
linuxPrevent PHP files from being served as plain text
Add to .htaccess: <FilesMatch "\.php$">
Deny from all
</FilesMatch>
Or: AddHandler application/x-httpd-php .php
Nginx Configuration Fix
linuxEnsure PHP files are passed to PHP-FPM
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php-fpm.sock;
include fastcgi_params;
}
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests for .php files that don't execute properly
- Move sensitive PHP files outside web root directory and use proper include paths
🔍 How to Verify
Check if Vulnerable:
Create test.php file with <?php echo 'test'; ?> in web root, then access via browser - if source code shows instead of 'test', system is vulnerableCheck Version:
Not version dependent - check webserver and PHP configuration insteadVerify Fix Applied:
After configuration changes, access test.php again - should show 'test' output, not source code📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to .php files with unusual content-length
- Multiple requests to .php files from single IP
Network Indicators:
- Unusual pattern of .php file requests without parameters
- Source code appearing in HTTP responses
SIEM Query:
source="webserver" AND (uri="*.php" OR uri ENDS WITH ".php") AND status=200 AND (bytes>5000 OR bytes<100)