themursalin/cve-2025-32432Exploit for Craft CMS pre-authentication RCE (CVE-2025-32432) chaining session poisoning with insecure deserialization to execute arbitrary commands on vulnerable servers.
Pre-Authentication Remote Code Execution in Craft CMS
Discovered & Developed by Mohammed Idrees Banyamer
CVE-2025-32432 is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting multiple versions of Craft CMS. By chaining unsanitised session data storage with an insecure deserialisation gadget, an unauthenticated attacker can execute arbitrary commands on the remote server.
| Branch | Vulnerable Up To |
|---|---|
| Craft CMS 3.x | ≤ 3.9.14 |
| Craft CMS 4.x | ≤ 4.14.14 |
| Craft CMS 5.x | ≤ 5.6.16 |
⚠️ All older versions exhibiting the described routing behaviour are also likely affected.
The vulnerability arises from chaining two distinct weaknesses in the assets/generate-transform endpoint:
Old routing behaviour writes raw query parameters directly into the PHP session file at /tmp/sess_<PHPSESSID>, with no sanitisation or filtering.
A Yii deserialisation gadget chain (FieldLayoutBehavior → PhpManager) allows an attacker to force the inclusion of an arbitrary file — in this case, the poisoned session file.
Combined impact: Full server compromise, data exfiltration, lateral movement, and more.
requestsurllib3# Install via requirements file
pip install -r requirements.txt
# Or install directly
pip install requests urllib3
python exploit.py -u <target_url> -c "<command>" [options]
| Flag | Description | Default |
|---|---|---|
-u, --url | Required. Target base URL (e.g. https://example.com) | — |
-c, --cmd | Required. System command to execute (e.g. id, whoami) | — |
-a, --asset | Known valid Asset ID (speeds up exploitation significantly) | None |
--scan-max | Max Asset ID to brute-force when no ID is provided | 300 |
-t, --timeout | Request timeout in seconds | 15 |
-v, --verbose | Enable verbose/debug output | Off |
# Auto-exploit — brute-forces Asset ID automatically
python exploit.py -u https://craft.example.com -c "id"
# With a known Asset ID — more reliable and faster
python exploit.py -u https://craft.example.com -c "cat /etc/passwd" -a 42
# Custom timeout + verbose output
python exploit.py -u https://craft.example.com -c "uname -a" -t 10 -v
Step 1 ──► Session Establishment
Fetch homepage → obtain PHPSESSID cookie
Step 2 ──► Asset ID Resolution
Provided via -a flag OR brute-forced (non-404 detection)
Step 3 ──► Session Poisoning
Malicious GET request → raw PHP injected into /tmp/sess_<PHPSESSID>
Step 4 ──► RCE Trigger
Crafted deserialisation payload → PhpManager includes session file
→ PHP executes → system command runs → output returned
💡 Command output is printed (first 2,000 characters). For full interaction, a reverse shell is recommended.
requirements.txt
requests>=2.31.0
urllib3>=2.0
This tool is intended solely for educational purposes and authorised security assessments.
Do not use it against any system without explicit, written permission from the system owner.
The author assumes no liability for any misuse or damage caused by this tool. By using this software, you agree that you are solely responsible for your own actions and will comply with all applicable local, national, and international laws.
| Role | Details |
|---|---|
| 🔍 CVE Discovery & Original Exploit | Mohammed Idrees Banyamer |
| 🐙 GitHub | @TheMursalin |
| 🤝 Code Refinement | Community contributions welcome |
⭐ If you find this useful, consider following @TheMursalin for more exploits, writeups, and security tools.
This project is released under the MIT License — see the LICENSE file for full details.