Description
CrushFTP是一款支持FTP, FTPS, SFTP, HTTP, HTTPS, WebDAV and WebDAV SSL等协议的跨平台FTP服务器软件。CVE-2023-43177 中，攻击者可构造恶意请求获取他人身份凭据，并实现权限提升，配合相关功能可造成远程代码执行，控制服务器。
CrushFTP 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nic.seu.edu.cn/info/1047/1285.htm
https://www.anquanke.com/post/id/311709
https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/
https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025
https://nvd.nist.gov/vuln/detail/CVE-2025-31161
https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/
https://projectdiscovery.io/blog/crushftp-rce
https://orionx.foregenix.com/blog/cve-2025-54309-rce-crushftp