Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-32432 — AI修复生成的CVE-2025-32432的poc | Kitploit
Tools/GitHubGitHub/bambooqj/cve-2025-32432
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingPayload Development
GitHubbambooqj/cve-2025-32432

CVE-2025-32432

AI修复生成的CVE-2025-32432的poc

View Repository
211 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CraftCMS CVE-2025-32432 Exploit Toolkit

Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research.

📁 File Description

🎯 Main Tools

  1. final_poc.py - Final optimized POC

    • Supports information disclosure and remote code execution
    • Automatic asset ID discovery
    • Multiple session injection methods
    • Detailed debug mode

  2. test.py - Simplified version based on the original SensePost article

    • Includes automatic asset ID retrieval
    • Uses yii\rbac\PhpManager method

  3. automated_testing.py - Automated testing framework

    • Concurrent testing of multiple targets
    • Detailed test report
    • JSON result output

📋 Auxiliary Files

  1. exploit_summary.md - Vulnerability analysis summary
  2. test_results.json - Automated test results
  3. vulnerable.txt - List of confirmed vulnerable targets

🚀 Usage

Basic Usage

root@kitploit:~
# 基本POC测试
python3 final_poc.py https://target.com/ id

# 调试模式
python3 final_poc.py https://target.com/ "whoami" --debug

# 简化版本
python3 test.py https://target.com/ "ls -la"

Automated Testing

root@kitploit:~
# 创建目标文件
python3 automated_testing.py --create-targets

# 运行批量测试
python3 automated_testing.py

⚠️ Important Notes

Vulnerability Mechanism

  1. Information Disclosure: Uses GuzzleHttp\Psr7\FnStream to call phpinfo()
  2. Code Execution: Uses yii\rbac\PhpManager to load PHP code from session files

Limitations

  • Site Lock Protection: Many CraftCMS sites have access protection enabled
  • Session Path: Session file paths may vary across environments
  • WAF Blocking: May be blocked by Web Application Firewalls

Test Environment

  • Command output may not be visible on protected sites
  • It is recommended to test in an unlocked test environment

🛡️ Protection Recommendations

  1. Upgrade CraftCMS to patched versions:

    • 3.9.15+
    • 4.14.15+
    • 5.6.17+

  2. Enable Site Lock to protect the admin panel

  3. Restrict session file access permissions

  4. Deploy WAF rules to detect malicious payloads

📖 Technical References

  • SensePost CVE-2025-32432 Analysis
  • CraftCMS Official Security Advisory

⚖️ Disclaimer

This tool is intended for security research and authorized penetration testing only. Users must comply with local laws and regulations and shall not use it for illegal purposes.

Download Tool