METASPLOIT-modules/auxiliary/gather/crushftp_authbypass_cve_2025_2825.rb

This Metasploit module exploits an authentication bypass in CrushFTP by crafting a malicious AWS4-HMAC-SHA256 header and session cookie, allowing an attacker to authenticate as any valid user without credentials.