Description
Craft CMS是一款灵活易用的内容管理系统 ，可用于在网页及其他平台上打造定制化的管理。Craft CMS从 3.0.0-RC1 版本到 3.9.15 之前的版本、4.0.0-RC1 版本到 4.14.15 之前的版本以及 5.0.0-RC1 版本到 5.6.17 之前的版本都存在远程代码执行漏洞，攻击者可通过特定的POST请求在未经身份验证的情况下执行任意代码，获取服务器权限。
Craft CMS /index.php 代码执行漏洞（CVE-2025-32432）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
https://nvd.nist.gov/vuln/detail/CVE-2025-32432
https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
https://www.sonicwall.com/blog/craftcms-vulnerability-exposes-systems-to-pre-auth-rce-now-exploited-in-the-wild-cve-2025-32432-
https://www.opswat.com/blog/cve-2025-32432-unauthenticated-remote-code-execution-in-craft-cms
https://www.rapid7.com/db/modules/exploit/linux/http/craftcms_preauth_rce_cve_2025_32432/
https://censys.com/advisory/cve-2025-32432/
https://thehackernews.com/2025/05/mimo-hackers-exploit-cve-2025-32432-in.html