Description
CrushFTP 10.0.0至10.8.3版本以及11.0.0至11.3.0版本存在身份验证绕过漏洞，攻击者可通过构造特殊的HTTP请求绕过身份验证，最终可能导致系统完全沦陷。
CrushFTP /WebInterface/function/ 未授权访问漏洞 （CVE-2025-2825）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.csdn.net/m0_50125527/article/details/146972819
https://tencentcloud.csdn.net/69ea42480a2f6a37c5a3ae97.html
https://cn-sec.com/archives/3921226.html
https://idocdown.com/app/articles/blogs/detail/16311
https://github.com/Threekiii/CVE/blob/master/README.md
https://projectdiscovery.io/blog/crushftp-authentication-bypass
https://nvd.nist.gov/vuln/detail/CVE-2025-2825
https://www.ionix.io/blog/critical-unauthenticated-access-vulnerability-in-crushftp-cve-2025-2825/
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Compromise
https://www.sonicwall.com/blog/critical-crushftp-authentication-bypass-cve-2025-2825-exposes-servers-to-remote-attacks
https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825
https://www.helpnetsecurity.com/2025/03/27/crushftp-vulnerability-cve-2025-2825/