Craft CMS 5.6.16 - RCE

ExploitDBExploitDB exploitExploitEDB-52525

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-32432 in Craft CMS by poisoning a PHP session file and triggering a Yii deserialization gadget chain to achieve unauthenticated remote command execution.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a proof-of-concept exploit for CVE-2025-32432 targeting Craft CMS. It performs session poisoning and deserialization to achieve remote code execution as described. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The script's behavior is consistent with its stated purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareCraft CMS
Attack typesremote code executiondeserializationsession poisoning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively executes a multi-step attack chain (session poisoning, deserialization trigger) to achieve arbitrary command execution on a remote target, which is the definition of an exploit.

exploits/multiple/webapps/52525.py:1exploits/multiple/webapps/52525.py:13-16exploits/multiple/webapps/52525.py:68-88exploits/multiple/webapps/52525.py:91-120

Requirements

  • Target running vulnerable Craft CMS version (<= 3.9.14, <= 4.14.14, <= 5.6.16)exploits/multiple/webapps/52525.py:8
  • Valid Asset ID on the target Craft CMS instanceexploits/multiple/webapps/52525.py:27-65
  • Target must write PHP session files to /tmp/sess_<PHPSESSID>exploits/multiple/webapps/52525.py:94

Observed behavior

  • Obtains a PHP session ID from the targetexploits/multiple/webapps/52525.py:143-151
  • Optionally brute-forces a valid Asset ID by sending deserialization payloads to /actions/assets/generate-transformexploits/multiple/webapps/52525.py:37-65
  • Poisons the PHP session file by sending a GET request with PHP code in a query parameterexploits/multiple/webapps/52525.py:75-76
  • Triggers deserialization via a crafted JSON payload to /actions/assets/generate-transform, causing PhpManager to include the poisoned session file and execute the injected commandexploits/multiple/webapps/52525.py:97-120
  • Prints the server response, which may contain command outputexploits/multiple/webapps/52525.py:180-181
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
system('{cmd}')The script injects a user-supplied command into a PHP session file and triggers its execution via deserialization, which is the core exploit mechanism.exploits/multiple/webapps/52525.py:75
Network Request
requests.get/requests.post to target base_urlAll network requests are directed solely at the user-specified target URL, with no external or unrelated endpoints contacted.exploits/multiple/webapps/52525.py:38exploits/multiple/webapps/52525.py:76exploits/multiple/webapps/52525.py:97
Session Handling
PHPSESSID cookie extractionThe script obtains a session ID from the target to construct the path to the poisoned session file, a necessary step for the exploit.exploits/multiple/webapps/52525.py:144-145
Review boundaries

What the analysis did not establish

  • Only the exploit script is analyzed; external libraries (requests, urllib3) and their behavior are not inspected.
  • The script's effectiveness depends on server-side conditions (session file path, asset ID existence) that are not verified in the evidence.
  • No network traffic or execution output is captured; analysis is based solely on static code review.
  • The review is limited to the provided Python script text. No external dependencies (e.g., the 'requests' library) were analyzed.
  • The script's behavior depends on the target environment; no runtime analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1