Description
CrushFTP 是一种流行的文件传输服务器软件，版本 10.0.0 至 10.8.3 和 11.0.0 至 11.3.0 存在身份验证绕过漏洞。攻击者可以通过发送特制的 HTTP 请求，绕过身份验证机制，获得未经授权的访问权限。这可能导致敏感数据泄露或进一步的攻击。
CrushFTP /WebInterface/function/ 权限绕过漏洞（CVE-2025-31161）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-31161
https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo
https://github.com/Immersive-Labs-Sec/CVE-2025-31161
https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
https://www.exploit-db.com/exploits/52295
https://projectdiscovery.io/blog/crushftp-authentication-bypass
https://www.tenable.com/cve/CVE-2025-31161
https://arcticwolf.com/resources/blog/cve-2025-31161/
https://juejin.cn/post/7611424475898855451
https://cve.imfht.com/intel/384689