Crafty Controller - Authenticated Remote Code Execution via Webhook Template Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2025-14700. PoCs published by adminlove520, Nosiume, secdongle.
AI-analyzed exploit summary This is a functional exploit for CVE-2025-14700, targeting Crafty Controller. It leverages a template injection vulnerability in the webhook functionality to achieve remote code execution (RCE) by creating a malicious webhook payload that triggers a reverse shell.
Description
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
Exploits (3)
This is a functional exploit for CVE-2025-14700, targeting Crafty Controller. It leverages a template injection vulnerability in the webhook functionality to achieve remote code execution (RCE) by creating a malicious webhook payload that triggers a reverse shell.
This PoC exploits a template injection vulnerability in Crafty Controller to achieve remote code execution via a malicious webhook payload. It authenticates, creates a server, and triggers a reverse shell through a crafted Discord webhook.
This is a functional PoC for CVE-2025-14700, exploiting a Server-Side Template Injection (SSTI) vulnerability in Crafty Controller <= 4.6.1 to achieve Remote Code Execution (RCE) via Jinja2 template injection in Webhook configurations. The exploit automates authentication, session handling, and payload delivery for a reverse shell.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H