ezramansor/cve-2025-32432-pocA simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go
This repository contains a professional proof-of-concept (PoC) exploit written in Go, designed to demonstrate a critical vulnerability chain in Craft CMS. The exploit leverages a log-poisoning vulnerability that leads to Local File Inclusion (LFI), ultimately achieving Remote Code Execution (RCE) via a reverse shell.
The exploit follows a multi-stage execution chain:
The tool begins by sending an unauthenticated GET request to the target. By manipulating the a parameter and providing a custom CraftSessionId via cookies, the attacker can force the application to write a PHP payload into the session log file located at /var/lib/php/sessions/sess_[sessionId].
To interact with the generate-transform endpoint, the tool automatically extracts the necessary X-CSRF-Token and CRAFT_CSRF_TOKEN cookies from the administrative interface, ensuring the subsequent POST request is accepted by the server.
The tool exploits the generate-transform endpoint by passing a specially crafted JSON payload. By abusing the \yii\rbac\PhpManager class through a behavior injection, the tool triggers a Local File Inclusion (LFI) of the previously poisoned session log. Once the PHP code in the log is executed, the tool invokes a Python-based reverse shell.
Unlike traditional scripts, this tool implements a concurrent TCP listener using Go routines. This allows the tool to automatically catch the reverse shell connection on a specified port, providing a seamless "one-click" experience from exploit delivery to shell access.
go run main.go
Follow the on-screen prompts to provide the target URL, your listener port, and your IP address.
This tool is for educational and authorized testing purposes only.