CVE-2025-57439
📋 TL;DR
CVE-2025-57439 is a critical remote code execution vulnerability in Creacast Creabox Manager 4.4.4 where authenticated attackers can inject arbitrary Lua code via the edit.php endpoint. This allows complete server compromise including reverse shell execution and arbitrary command execution. Organizations using Creabox Manager 4.4.4 are affected.
💻 Affected Systems
- Creacast Creabox Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, lateral movement within the network, and persistent backdoor installation.
Likely Case
Attacker gains shell access to the server, exfiltrates sensitive data, and potentially compromises other systems on the same network.
If Mitigated
Limited impact if network segmentation, strict access controls, and monitoring prevent lateral movement and data exfiltration.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once credentials are obtained. Public proof-of-concept code exists in the referenced GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.creacast.com/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch is released, download and apply it according to vendor instructions. 3. Verify the fix by testing the edit.php endpoint.
🔧 Temporary Workarounds
Block edit.php endpoint
allRestrict access to the vulnerable endpoint using web server configuration or firewall rules.
# Apache: RewriteRule ^edit\.php$ - [F]
# Nginx: location ~ ^/edit\.php$ { deny all; }
# Firewall: iptables -A INPUT -p tcp --dport 80 -m string --string "edit.php" --algo bm -j DROP
Implement strict authentication controls
allEnforce strong passwords, multi-factor authentication, and limit login attempts to reduce credential compromise risk.
# Implement MFA if supported
# Set strong password policy: min length 12, complexity required
# Configure fail2ban or similar for login attempts
🧯 If You Can't Patch
- Isolate the Creabox Manager system in a restricted network segment with no internet access.
- Implement application-level input validation to sanitize Lua code in configuration inputs.
🔍 How to Verify
Check if Vulnerable:
Check if Creabox Manager version is 4.4.4 and if edit.php endpoint accepts Lua code injection in configuration parameters.Check Version:
Check the application interface or configuration files for version information; specific command depends on installation.Verify Fix Applied:
Test if Lua code injection via edit.php no longer executes on the server after applying patches or workarounds.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to edit.php with Lua code patterns
- Unexpected process execution from web server user
- Authentication logs showing brute force attempts
Network Indicators:
- Outbound connections from web server to unknown IPs (reverse shells)
- Unusual traffic patterns to/from Creabox Manager port
SIEM Query:
source="web_logs" AND uri="/edit.php" AND (body="os.execute" OR body="io.popen" OR body="loadstring")