CVE-2013-2097

HIGH

ZPanel through 10.1.0 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2013-2097. PoCs published by Metasploit, Sven Slootweg, Balazs Makany, Jose Antonio Perez, dawn isabel, brad wolfe, brent morris, james fitts, including Metasploit module exploits/multi/http/zpanel_information_disclosure_rce.

AI-analyzed exploit summary This Metasploit module exploits an information disclosure vulnerability in Zpanel via a vulnerable version of pChart to read arbitrary files, extract MySQL credentials, and achieve remote code execution by uploading a malicious PHP payload through PHPMyAdmin.

Description

ZPanel through 10.1.0 has Remote Command Execution

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/38505

This Metasploit module exploits an information disclosure vulnerability in Zpanel via a vulnerable version of pChart to read arbitrary files, extract MySQL credentials, and achieve remote code execution by uploading a malicious PHP payload through PHPMyAdmin.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Zpanel (using vulnerable pChart version)
No auth needed
Prerequisites: Zpanel with vulnerable pChart version · Access to PHPMyAdmin
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP
by Sven Slootweg · textwebappsphp
https://www.exploit-db.com/exploits/25519

The vulnerability in ZPanel's template parser allows arbitrary PHP code execution due to insufficient filtering of malicious code in template files. Combined with the `zsudo` binary, this can lead to root command execution.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ZPanel (version not specified)
Auth required
Prerequisites: Access to a reseller or administrator account · Ability to upload custom templates
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Balazs Makany, Jose Antonio Perez, dawn isabel, brad wolfe, brent morris, james fitts · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb

This Metasploit module exploits an information disclosure vulnerability in ZPanel (CVE-2013-2097) via a vulnerable version of pChart to read arbitrary files, extract MySQL credentials, and achieve remote code execution by uploading a malicious PHP payload through PHPMyAdmin.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ZPanel (using pChart < 2.1.3)
No auth needed
Prerequisites: ZPanel with vulnerable pChart version · PHPMyAdmin accessible · MySQL credentials extractable via file read
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://www.exploit-db.com/exploits/25519
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2013/05/16/12
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2013/05/16/16
Third Party Advisory, VDB Entry x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/84364

Scores

CVSS v3 7.8
EPSS 0.2547
EPSS Percentile 97.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
zpanel_project/zpanel 10.1.0
Published Feb 12, 2020
Tracked Since Feb 18, 2026