Pre-authentication RCE in Craft CMS image transformation

Small standalone Go exploit repository with 4 files: LICENSE, README.md, go.mod, and a single code file main.go. The code is a direct PoC for CVE-2025-32432 against Craft CMS and is not part of a larger exploit framework. main.go implements the full attack chain: (1) poisonLog() sends an unauthenticated GET request to /index.php?p=admin/dashboard with a malicious a parameter containing PHP code and a chosen CraftSessionId cookie so the payload is written into a predictable PHP session file; (2) getCookiesandTokens() requests /admin and parses the HTML plus response cookies to recover the CSRF token material needed for the next step; (3) setupListener() starts a local TCP listener to catch the shell; and (4) exploit() POSTs JSON to /actions/assets/generate-transform, abusing Yii class/behavior injection to instantiate \yii\rbac\PhpManager with itemFile pointing to /var/lib/php/sessions/sess_<sessionId>, causing local file inclusion and execution of the poisoned PHP. The executed PHP reads the cmd query parameter, which contains a hardcoded Python3 reverse shell that connects back to the attacker and spawns /bin/sh -i. The tool is operational rather than just demonstrative because it automates token retrieval, exploitation, and listener setup, but the payload is basic and hardcoded rather than modular.

Repository contains a single Python exploit script and a minimal README with an example reverse-shell invocation. The main file, craft_rce.py, is a standalone unauthenticated web RCE exploit targeting Craft CMS. It accepts a base URL, an arbitrary command, and an optional Host header. The exploit first monkey-patches urllib3 request handling so encoded request targets are sent unquoted, then sends a GET request to /index.php with a crafted parameter containing PHP code (<?=system($_GET["cmd"]);die()?>). This appears intended to poison server-side session content associated with the returned CraftSessionId cookie. Next, it requests /admin/login to scrape the CRAFT_CSRF_TOKEN from the HTML. Finally, it POSTs to /index.php?p=actions/assets/generate-transform with a malicious JSON body that abuses Yii/Craft object construction fields (__class, __construct()) to instantiate yii\rbac\PhpManager and point itemFile at /var/lib/php/sessions/sess_{session_id}. This causes the application to process the attacker-controlled session file and execute the supplied cmd parameter. The script then parses and prints the command output from the HTTP response. The README demonstrates operational use by base64-encoding a bash reverse shell and passing it as the command, showing the exploit is capable of full remote shell access, not just benign command execution.

This repository is a small standalone Go exploit for CVE-2025-32432 targeting Craft CMS pre-authenticated remote code execution. The repository contains only three files: a README describing the attack flow and usage, a minimal go.mod, and a single executable source file main.go that implements the exploit logic. The exploit workflow is fully offensive rather than diagnostic. It first creates an HTTP session with cookie jar support and disabled TLS verification. It requests /admin/login to obtain a CraftSessionId cookie and scrape a CSRF token from the HTML/JS response using a regex. It then performs session poisoning by sending a GET request to /index.php with a crafted query string containing embedded PHP code: <?=passthru($_GET["cmd"]);die()?>. After a short delay, it brute-forces asset IDs by repeatedly POSTing JSON to /index.php?p=admin/actions/assets/generate-transform using a crafted object structure; any response other than 404 is treated as a potentially valid assetId. Once a candidate assetId is found, the exploit sends a second crafted POST to the same generate-transform action, this time building an object graph that points itemFile to /var/lib/php/sessions/sess_<CraftSessionId>. It also appends the attacker-controlled cmd parameter to the request URL. If successful, the poisoned session file is included and the embedded PHP executes the supplied system command via passthru(), returning output in the HTTP response body. The program then strips trailing HTML and prints the command output. Notable capabilities include unauthenticated command execution and easy adaptation to a reverse shell, as documented in the README with a base64-encoded bash payload example. The code is operational but basic: it has hardcoded assumptions about PHP session storage location, brute-forces asset IDs up to 300, and relies on specific Craft CMS endpoints and gadget classes. There is no modular framework integration, persistence, or post-exploitation automation beyond arbitrary command execution.

Repository contains a small standalone Python exploit PoC for Craft CMS CVE-2025-32432 and a README documenting usage and affected versions. The main entry point is exploit.py. The script is not part of a larger exploitation framework. Exploit structure and purpose: 1. It normalizes the target base URL and creates a requests session with TLS verification disabled. 2. It attempts to obtain a CSRF token by requesting several likely Craft CMS admin/login/front-controller URLs. 3. It builds multiple candidate asset transform endpoints and probes them with a phpinfo gadget payload rather than a normal transform request, specifically to avoid false negatives. 4. The phpinfo gadget uses a crafted object structure referencing craft\\behaviors\\FieldLayoutBehavior and GuzzleHttp\\Psr7\\FnStream with _fn_close set to phpinfo, confirming gadget execution when the response contains phpinfo markers. 5. If only validation is requested, the script stops after confirming vulnerability. 6. If a command is supplied, the exploit proceeds to a second stage: it identifies the session cookie, poisons a Craft return URL/session value with raw embedded PHP, then triggers inclusion of the corresponding PHP session file via a yii\\rbac\\PhpManager include chain from likely session directories. 7. The operator command is hex-encoded before transport to reduce quoting and metacharacter issues. The README explicitly supports simple commands and reverse-shell commands supplied by the user. Notable implementation details: - The code monkey-patches urllib3's HTTPConnectionPool._make_request to unquote URLs before sending, ensuring raw PHP tags survive request construction during session poisoning. - Discovery logic tests multiple route formats and asset IDs, making the PoC more reliable than simplistic single-endpoint checks. - The exploit supports manual override of endpoint, assetId, front controller, session directory list, and timeout. Overall assessment: this is a real, functional single-target unauthenticated web RCE PoC with both detection/confirmation and exploitation capability. It is more than a detector because it includes a command-execution chain, but it remains a standalone PoC rather than a weaponized framework module.

This repository is a small standalone exploit PoC for CVE-2025-32432, a pre-authentication RCE affecting Craft CMS via Yii2 behavior injection and __class override abuse. The repository contains 4 files: one Python exploit (exploit.py), a README with usage and attack flow, an ANALYSIS.md document with detailed vulnerability background and exploitation theory, and a VS Code settings file. The only executable exploit logic is in exploit.py. The exploit is implemented in Python using requests, urllib3, argparse, regex, and time. It is not part of a larger exploitation framework. The script performs a 4-stage attack chain: (1) GET /admin/login to obtain a CraftSessionId cookie and scrape the CRAFT_CSRF_TOKEN value; (2) poison the server-side PHP session file by sending a GET request to /index.php with p=admin/dashboard and an a parameter containing PHP code <?=passthru($_GET["cmd"]);die()?>; (3) brute-force a valid assetId by POSTing JSON to /index.php?p=admin/actions/assets/generate-transform using a behavior payload that passes validation with craft\behaviors\FieldLayoutBehavior but actually instantiates GuzzleHttp\Psr7\FnStream via __class; and (4) trigger code execution by POSTing another crafted JSON payload to the same generate-transform action, this time instantiating yii\rbac\PhpManager with itemFile set to the poisoned session file path so the injected PHP is included and executed. Main exploit capabilities: unauthenticated remote exploitation over HTTP(S), automatic CSRF/session handling, automatic asset ID brute-force, fallback session path retries, arbitrary command execution via cmd query parameter, and command output extraction from the HTTP response. The payload is operational rather than merely demonstrative because it includes a working command-execution primitive and practical automation, though payload customization is manual through the -c argument. Notable assumptions and targeting details: the target must expose Craft admin routes without prior authentication barriers that prevent session/token acquisition, must use a vulnerable Craft/Yii stack, and must store PHP sessions in predictable filesystem locations. The exploit specifically targets Craft CMS versions 3.0.0-RC1 through 5.6.16, matching the documentation in README.md and ANALYSIS.md. The README also includes example post-exploitation usage such as reading /etc/passwd or launching a reverse shell.

Repository is a small Python PoC set for CVE-2025-32432 affecting Craft CMS. It contains two executable scripts and minimal supporting files (README, LICENSE, requirements, .gitignore). `craftcms_rce_php_check.py` is a threaded scanner/checker that accepts a single URL or a file of URLs, detects Craft CMS version, extracts a CSRF token from the admin dashboard, and sends a crafted JSON payload to `/index.php?p=admin/actions/assets/generate-transform` to invoke `phpinfo()` through gadget/object abuse. If successful, it marks the target vulnerable and extracts useful environment details such as `CRAFT_DB_DATABASE` and the HOME directory, saving results to `vulnerable.txt`. `craftcms_final_payload.py` is the actual exploitation script: it detects version, brute-forces a valid `assetId` if one is not supplied, injects PHP code `<?=exec($_GET['cmd']);die();?>` into session-backed state via a crafted request to `/index.php` with `p=admin/dashboard`, extracts `CRAFT_CSRF_TOKEN` and `CraftSessionId`, then triggers the vulnerable asset transform action at `/index.php?p=actions/assets/generate-transform` with a malicious object structure referencing `/tmp/sess_<session_id>`. This yields arbitrary command execution with command output parsed from the HTTP response. Overall, the repository’s purpose is both vulnerability validation and practical RCE exploitation against vulnerable Craft CMS 3.x/4.x/5.x instances.

Small standalone Python exploit repository for CVE-2025-32432 targeting Craft CMS. The repo contains one main code file (exploit.py), a detailed README, requirements.txt, and license metadata. The exploit is not framework-based. Core capability: unauthenticated RCE against vulnerable Craft CMS by abusing the anonymous /actions/assets/generate-transform endpoint. The script obtains a CSRF token from /actions/users/session-info, poisons a server-side file (default nginx access.log) by sending PHP in the User-Agent header, then POSTs crafted handle[...] parameters so Craft/Yii instantiates yii\rbac\PhpManager with itemFile pointing to the poisoned file. Because PhpManager ultimately require()s itemFile, the injected PHP executes on the server. Operational flow in exploit.py: initialize a requests session with TLS verification disabled; optionally perform a lab-specific PATCH /login to obtain a coopsess cookie; fetch CSRF token; poison the log via GET /; trigger the vulnerable endpoint via POST /actions/assets/generate-transform; parse returned output; and optionally support reverse-shell execution with a locally spawned nc/ncat listener. The README also documents alternate itemFile paths and a more persistent header-driven PHP webshell concept. Notable targeting details: requires a reachable Craft CMS instance, a valid assetId, and a writable/parsable sink such as /var/log/nginx/access.log. The README states affected versions as Craft CMS <= 5.6.16, <= 4.15.2, <= 3.9.14, and Yii2 <= 2.0.49, with fixes in Craft 5.6.17+ and Yii2 2.0.50. Overall, this is a real operational PoC with built-in command execution and reverse-shell support rather than a mere detector.

This repository is a small standalone Python exploit for CVE-2025-32432, a pre-authentication remote code execution vulnerability in Craft CMS. It contains two files: a README describing the vulnerability, affected versions, and usage, and exploit.py, the actual exploit implementation. No external framework such as Metasploit or Nuclei is used. The exploit is operational and performs a full attack chain against a remote Craft CMS target. First, it establishes a session by requesting /index.php and extracting the PHPSESSID cookie. Second, if the operator does not provide a known asset ID, it brute-forces one by POSTing crafted JSON to /actions/assets/generate-transform and treating any non-404 response as a likely valid assetId. Third, it poisons the PHP session by sending a GET request to /index.php with query parameters including attacker-controlled PHP code in parameter a, relying on the vulnerable routing/session behavior to write raw input into /tmp/sess_<PHPSESSID>. Finally, it triggers deserialization by POSTing another crafted JSON object to /actions/assets/generate-transform, abusing the craft\\behaviors\\FieldLayoutBehavior -> yii\\rbac\\PhpManager gadget chain so itemFile points to the poisoned session file. When included, the injected PHP executes system('<command>'). Main exploit capabilities: unauthenticated remote command execution, optional asset ID brute-forcing, session establishment and cookie harvesting, session poisoning, and retrieval/display of server response content. The payload is basic but functional: arbitrary shell command execution through PHP's system() call. The script supports operator-supplied target URL, command, optional asset ID, brute-force range, timeout, and verbose logging. Fingerprintable targets and artifacts in code include the Craft CMS routes /index.php and /actions/assets/generate-transform, the PHP session cookie PHPSESSID, and the local server file path /tmp/sess_<PHPSESSID>. The exploit specifically targets Craft CMS versions 3.9.14 and earlier, 4.14.14 and earlier, and 5.6.16 and earlier, as stated in the repository.

This repository contains a fully functional exploit for CVE-2025-32432, a critical pre-authentication remote code execution (RCE) vulnerability in Craft CMS versions 3.x, 4.x, and 5.x prior to their respective patched releases. The exploit is implemented in Python (CVE-2025-32432.py) and automates the attack by first extracting a CSRF token from the admin dashboard, then sending a specially crafted JSON payload to the /index.php?p=admin/actions/assets/generate-transform endpoint. This payload leverages PHP object deserialization to execute arbitrary PHP code (demonstrated with phpinfo). The script supports both single and multiple target modes, uses threading for efficiency, and writes results to a file. The README.md provides detailed vulnerability, exploitation, and mitigation information. The exploit is operational and can be used to verify and demonstrate RCE on vulnerable Craft CMS instances.

This repository provides a comprehensive and operational exploit toolkit for CVE-2025-32432, a critical remote code execution (RCE) and information disclosure vulnerability in CraftCMS. The main exploit script (CVE-2025-32432.py) implements multiple session injection techniques by abusing the 'returnUrl' and 'a' parameters on various admin endpoints to inject PHP code into the session file. It then discovers a valid asset ID and crafts JSON payloads to trigger either information disclosure (via GuzzleHttp\Psr7\FnStream and phpinfo()) or RCE (via yii\rbac\PhpManager loading the session file). The exploit is highly automated, with robust output parsing, error handling, and debug options. An additional script (automated_testing.py) enables concurrent testing of multiple targets and saves results in JSON format. The repository includes detailed documentation (README.md, USAGE.md, exploit_summary.md) outlining usage, technical details, and mitigation advice. The exploit targets CraftCMS versions prior to 3.9.15, 4.14.15, and 5.6.17, and requires the ability to write and read PHP session files on the server. The attack vector is network-based, targeting exposed CraftCMS admin endpoints. Key fingerprintable endpoints include various admin URLs and the PHP session file path. The exploit is not a framework module but is mature and operational, providing both RCE and information disclosure capabilities.

This repository provides two Python scripts for exploiting CVE-2025-32432, a pre-authentication remote code execution vulnerability in CraftCMS versions 3.x, 4.x, and 5.x. The exploit leverages a two-step attack chain: first, it injects arbitrary PHP code into a session file via a GET request to the admin dashboard endpoint; second, it uses a POST request to the asset-transform endpoint with a crafted deserialization gadget to require and execute the session file, resulting in arbitrary command execution. The main script, 'craftcms_final_payload.py', automates this process, including brute-forcing the required assetId if not provided. The secondary script, 'craftcms_rce_php_check.py', is a low-impact probe that checks for exploitability by attempting to execute phpinfo(). The repository is well-documented, includes installation and usage instructions, and targets unauthenticated attackers over HTTP/HTTPS. The exploit is operational, providing a working payload for arbitrary shell command execution on vulnerable CraftCMS instances.

This repository contains a single Metasploit module targeting Craft CMS (versions 3.x, 4.x, and 5.x prior to 5.6.17) for an unauthenticated remote code execution vulnerability (CVE-2025-32432). The exploit abuses the image transform endpoint to inject a PHP payload into the session file, then triggers its execution via a PHP object injection gadget chain. The module is weaponized, supporting both PHP Meterpreter and command shell payloads, and requires no authentication. The main endpoints targeted are the image transform and admin dashboard endpoints of Craft CMS, and the exploit manipulates session files on the server. The code is written in Ruby and is structured as a standard Metasploit exploit module, with all logic contained in a single file.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-32432, a pre-authentication remote code execution (RCE) vulnerability in CraftCMS versions 4.x and 5.x. The exploit is implemented in a single Python script, 'craftcms_rce.py', which automates the process of detecting and exploiting the vulnerability. The script works by first retrieving a CSRF token from the CraftCMS admin dashboard, then sending a specially crafted JSON payload to the asset transform generation endpoint. This payload leverages PHP object injection to trigger code execution via the 'GuzzleHttp\Psr7\FnStream' class, with the default action being execution of 'phpinfo()' to verify exploitation. The script supports both single and multiple target modes, multi-threaded scanning, and outputs results to both the console and a CSV file ('vulnerable.txt'). The exploit extracts and reports sensitive information such as the database name and home directory from the target upon successful exploitation. The repository is well-documented, with a detailed README explaining usage, technical details, and output format. No hardcoded IPs or domains are present; the script takes user-supplied targets as input.