full-disclosure - [FD] [KIS-2025-09] Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection Vulnerability

Open Source and information security mailing list archives

Message-ID: <CAJeQoQcR=rCiKrjXwTawQjYjGaQGQUE4QV2akGxDwBUvSz=1tA@mail.gmail.com>
Date: Tue, 16 Dec 2025 11:36:47 +0100
From: Egidio Romano <n0b0d13s@...il.com>
To: fulldisclosure@...lists.org
Cc: submissions@...ketstormsecurity.com, submit@...sec.com
Subject: [FD] [KIS-2025-09] Control Web Panel <= 0.9.8.1208
 (admin/index.php) OS Command Injection Vulnerability

------------------------------------------------------------------------------------
Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection
Vulnerability
------------------------------------------------------------------------------------

[-] Software Link:

https://control-webpanel.com

[-] Affected Versions:

Version 0.9.8.1208 and prior versions.

[-] Vulnerability Description:

User input passed via the "key" GET parameter to /admin/index.php
(when the "api" parameter is set) is not properly sanitized before
being used to execute OS commands. This can be exploited by
unauthenticated attackers to inject and execute arbitrary OS commands
with the privileges of the root user on the web server.

Successful exploitation of this vulnerability requires "Softaculous"
and/or "SitePad" to be installed through the Scripts Manager.

[-] Proof of Concept:

https://[CWP]/admin/index.php?api=1&key=$(cmd)

[-] Solution:

Upgrade to version 0.9.8.1209 or later.

[-] Disclosure Timeline:

[12/03/2025] - Vulnerability discovered
[22/07/2025] - Version 0.9.8.1209 released, issue fixed by the vendor
[12/11/2025] - CVE identifier requested
[12/12/2025] - CVE identifier assigned
[16/12/2025] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures program (cve.org) has
assigned the name CVE-2025-67888 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2025-09
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives