HTB Orion: CraftCMS CVE-2025-32432 RCE Exploited in Hack The Box Challenge

·1 views

A Hack The Box machine named Orion, rated Very Easy, runs CraftCMS 5.6.16 on nginx, which is vulnerable to an unauthenticated remote code execution flaw tracked as CVE-2025-32432. The vulnerability exploits Yii's object-configuration system via the image transform endpoint, allowing attackers to instantiate arbitrary PHP classes through attacker-controlled JSON. A security researcher manually bypassed CSRF protections by extracting session cookies and token values from the login page before confirming arbitrary function execution. The Metasploit module for the exploit initially failed due to a missing VHOST setting and a persistent reverse shell connectivity issue, despite the target sending SYN packets to the listener. The researcher ultimately pivoted to a webshell-based approach to achieve command execution without requiring an inbound connection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI May Weaken Cognition, But Learning Its Thinking Style Could Be the Fix

Research from MIT Media Lab found that people who wrote essays using an LLM showed weaker brain connectivity and poorer recall than those who wrote unaided, a phenomenon researchers termed 'cognitive debt.' A separate study of 666 participants found a negative correlation between frequent AI use and critical thinking, linked to cognitive offloading. Historically, similar concerns arose with writing and calculators, suggesting that technology routinely displaces certain mental skills while society accepts the trade-off. Rather than debating whether to use AI for knowledge extraction or task collaboration, one perspective argues the real value lies in internalizing AI's underlying reasoning process. Unlike absorbed facts or divided labor, this mode of thinking is argued to be durable and independent of any platform or subscription remaining active.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Rust Is Winning Over Systems Programmers Worldwide

Rust is a modern systems programming language originally created by Mozilla and now maintained by a large open-source community. It was designed to address the core weaknesses of C and C++, specifically memory safety and data race conditions, without relying on a garbage collector. Its ownership and borrowing system enforces memory safety at compile time, meaning many classes of bugs are caught before the program ever runs. While Rust's strict compiler can be challenging for newcomers, the trade-off is highly reliable and performant software with minimal runtime failures. Combined with the Cargo package manager and built-in tooling, Rust is increasingly used for high-load systems, backend services, WebAssembly, and command-line utilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Your AI Support Agent Should Propose Answers, Not Send Them

A tutorial published on DEV Community argues that the most reliable AI support agent is one deliberately prevented from sending replies without human approval. The author distinguishes between demonstrating AI capability and making production-grade decisions, noting that fluency does not equal authority. The guide walks developers through building a Node.js workflow where an AI proposes a category, urgency level, and draft reply, while deterministic policy checks flag sensitive topics such as billing, security, and account access. A human reviewer must approve any proposal before it reaches the user, and the system enforces this through code invariants rather than model instructions. The project uses Express, SQLite, and Zod to keep the workflow reproducible, with replay support for testing when prompts or models change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer ditches AI specs for live code references, cuts correction rounds sharply

A developer managing a fleet of 600 web tools found that feeding abstract specification documents to Claude Code consistently produced only 80% quality output, requiring multiple correction rounds. To fix this, they restructured their AI agent workflow so the agent copies a live, production-deployed reference instead of reading static specs, which tend to diverge from reality over time. They also split 'build new tool' and 'repair existing tool' tasks into completely separate skills, arguing that merging them bloats procedures and wastes the agent's finite context window. The repair workflow was designed as a routing system that directs the agent to only the relevant category of reference material, preventing hallucinated fixes. A final safeguard was added: critical rules that must never be violated are enforced by automated write-time hooks rather than relying solely on the agent reading advisory documents.

0 comments Read more at DEV Community