{"uuid": "bc9aaf15-35f5-4099-a1e1-351d9d5d452b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64\", \"author\": [\"Lukas Johannes M\\u00f6ller\", \"Egidio Romano\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Control Web Panel (CWP) versions <= 0.9.8.1208 are vulnerable to\\n          unauthenticated OS command injection. User input passed via the\\n          \\\"key\\\" GET parameter to /admin/index.php (when the \\\"api\\\" parameter is set)\\n          is not properly sanitized before being used to execute OS commands.\\n          This can be exploited by unauthenticated attackers to inject and execute\\n          arbitrary OS commands with the privileges of the root user on the web server.\\n\\n          Successful exploitation usually requires \\\"Softaculous\\\" and/or \\\"SitePad\\\"\\n          to be installed through the Scripts Manager.\", \"disclosure_date\": \"2025-12-16\", \"fullname\": \"exploit/linux/http/control_web_panel_api_cmd_exec\", \"is_install_path\": true, \"mod_time\": \"2026-01-13 14:24:04 +0000\", \"name\": \"Control Web Panel /admin/index.php Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/control_web_panel_api_cmd_exec\", \"references\": [\"CVE-2025-67888\", \"URL-https://karmainsecurity.com/KIS-2025-09\", \"URL-https://www.cve.org/CVERecord?id=CVE-2025-67888\", \"URL-https://control-webpanel.com\"], \"rport\": 2031, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:28.342448Z"}