PT-2025-38760 · Creacast · Creabox Manager

Published 2025-09-22 · Updated 2025-10-17 · CVE-2025-57439

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Creacast Creabox Manager version 4.4.4

Description A critical Remote Code Execution issue exists in Creacast Creabox Manager version 4.4.4. An authenticated attacker can inject arbitrary Lua code into the configuration through the edit.php endpoint. This injected code is then executed on the server, potentially leading to full system compromise, including the ability to execute arbitrary commands or establish a reverse shell. The vulnerable API endpoint is /edit.php. The vulnerable parameter is the configuration data submitted to the edit.php endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-57439

Affected Products

Creabox Manager

References · 6

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57439 · Exploit
• https://osv.dev/vulnerability/CVE-2025-57439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57439 · Security Note
• https://t.me/cveNotify/139265 · Telegram Post
• http://creacast.com · Note
• https://twitter.com/CVEnew/status/1970184005245936036 · Twitter Post