Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-2825 — Exploit script for CrushFTP authentication bypass (CVE-2025-2825) using crafted Authorization header and CrushAuth cookie to gain unauthorized access. | Kitploit
Tools/GitHubGitHub/wooooong/cve-2025-2825
Authentication & AuthorizationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubwooooong/cve-2025-2825

CVE-2025-2825

Exploit script for CrushFTP authentication bypass (CVE-2025-2825) using crafted Authorization header and CrushAuth cookie to gain unauthorized access.

View Repository
131 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass (CVE-2025-2825) PoC

This script exploits the CrushFTP authentication bypass vulnerability in versions:

  • 10.0.0 ~ 10.8.3
  • 11.0.0 ~ 11.3.0

How It Works

CrushFTP's AWS S3-style authentication can be bypassed using:

  • A fake but valid-looking Authorization header
  • A specifically crafted CrushAuth cookie where the last 4 chars match c2f param

Usage

root@kitploit:~
chmod +x exploit_crushftp.sh
./exploit_crushftp.sh http://<target>:<port>
Download Tool