## https://sploitus.com/exploit?id=E85749AC-6A89-588D-BE95-27230DB47199
# CVE-2025-32432 Craft CMS PoC
> Single-target proof-of-concept for Craft CMS CVE-2025-32432.
>
> This repository is intended for authorized security testing, CTFs, lab environments, and defensive validation only.
## Overview
CVE-2025-32432 is a Craft CMS remote code execution issue related to unsafe object creation through the image transform generation endpoint. Public analysis shows that exploitation can involve requests to the `assets/generate-transform` action and gadget-controlled object construction.
This PoC supports two modes:
1. **Check-only mode**: confirms vulnerability by triggering `phpinfo()` through a non-destructive gadget.
2. **Command mode**: after confirmation, performs the two-step session-file include chain to execute a single command on an authorized target.
The script is designed for **single-target testing only**. It does not include mass scanning, reverse shell helpers, persistence, file upload helpers, or post-exploitation automation.
## Affected Versions
According to the GitHub Advisory Database, affected Craft CMS versions include:
- `>= 3.0.0-RC1, = 4.0.0-RC1, = 5.0.0-RC1, HTTP 404`
This does not always mean the target is safe. Confirm using the `phpinfo()` gadget flow instead of a normal transform request.
## Defensive Guidance
For defenders:
- Update Craft CMS to a patched version.
- Rotate the `CRAFT_SECURITY_KEY` if compromise is suspected.
- Rotate database and environment secrets.
- Review webroot and upload directories for unexpected PHP files.
- Review logs for suspicious requests to `actions/assets/generate-transform`.
- Consider blocking POST bodies containing suspicious `__class` values at the edge/WAF.
## Ethics and Legal Notice
This project is provided for educational and defensive security research purposes only.
Do not run this tool against systems you do not own or do not have explicit permission to test. Unauthorized exploitation of public systems is illegal and unethical.
The author is not responsible for misuse or damage caused by this tool.
## References
- Craft CMS Advisory: https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
- GitHub Advisory Database: https://github.com/advisories/GHSA-f3gw-9ww9-jmc3
- SensePost / Orange Cyberdefense Analysis: https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-32432