Description
攻击者可构造恶意请求利用generate-transform端点触发反序列化,执行任意代码控制服务器,未经身份验证的攻击者可以通过该漏洞在目标服务器上注入恶意代码,最终获取服务器权限。
CraftCms 代码注入漏洞（CVE-2025-32432）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-32432
https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
https://github.com/bambooqj/CVE-2025-32432
https://cve.imfht.com/detail/CVE-2025-32432
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
https://www.rapid7.com/db/modules/exploit/linux/http/craftcms_preauth_rce_cve_2025_32432/
https://cn-sec.com/archives/4030053.html
https://avd.aliyun.com/detail?id=AVD-2025-32432
https://blog.csdn.net/m0_46699477/article/details/147567097