CVE-2025-54309

This repository contains a functional Python exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The PoC leverages a race condition by sending concurrent requests with manipulated session identifiers to extract user lists without proper authentication.

This repository contains a functional Python exploit for CVE-2025-54309, targeting CrushFTP's WebInterface. The exploit leverages a race condition and improper authentication handling to perform arbitrary file reads, user enumeration, and admin user creation.

This repository contains a functional exploit for CVE-2025-54309, targeting CrushFTP. The exploit includes multiple modes (user insertion, JAR upload, command execution) and leverages hardcoded authentication cookies to bypass authentication and perform privileged actions.

This repository provides a detailed technical analysis and proof-of-concept for an authentication bypass vulnerability in CrushFTP's AS2 module, including exploitation scripts and detection tools. The research includes a thorough breakdown of the vulnerability, affected endpoints, and mitigation strategies.

This repository contains a functional Python exploit for CVE-2025-54309, a race condition vulnerability in CrushFTP that allows authentication bypass and admin user creation. The exploit leverages concurrent HTTP requests to trigger the race condition, enabling unauthorized user creation with admin privileges.

This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages a race condition to create an administrative user by sending concurrent requests with and without the AS2-TO header.

This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages improper AS2 header validation to create administrative users without authentication.