CVE-2025-14700

This is a functional exploit for CVE-2025-14700, targeting Crafty Controller. It leverages a template injection vulnerability in the webhook functionality to achieve remote code execution (RCE) by creating a malicious webhook payload that triggers a reverse shell.

This PoC exploits a template injection vulnerability in Crafty Controller to achieve remote code execution via a malicious webhook payload. It authenticates, creates a server, and triggers a reverse shell through a crafted Discord webhook.

This is a functional PoC for CVE-2025-14700, exploiting a Server-Side Template Injection (SSTI) vulnerability in Crafty Controller <= 4.6.1 to achieve Remote Code Execution (RCE) via Jinja2 template injection in Webhook configurations. The exploit automates authentication, session handling, and payload delivery for a reverse shell.