CVE-2025-67888

HIGH

Control Web Panel /admin/index.php Unauthenticated RCE

STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-67888. PoCs published by reewardius, Lukas Johannes Möller, Egidio Romano, including Metasploit module exploits/linux/http/control_web_panel_api_cmd_exec.

AI-analyzed exploit summary The repository provides a functional proof-of-concept for an OS command injection vulnerability in Control Web Panel (CWP) versions <= 0.9.8.1208. The exploit leverages unsanitized input via the 'key' GET parameter in '/admin/index.php' when the 'api' parameter is set, allowing unauthenticated attackers to execute arbitrary commands with root privileges.

Description

An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.

Exploits (2)

github WORKING POC
by reewardius · poc
https://github.com/reewardius/CVE-2025-67888

The repository provides a functional proof-of-concept for an OS command injection vulnerability in Control Web Panel (CWP) versions <= 0.9.8.1208. The exploit leverages unsanitized input via the 'key' GET parameter in '/admin/index.php' when the 'api' parameter is set, allowing unauthenticated attackers to execute arbitrary commands with root privileges.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Control Web Panel (CWP) <= 0.9.8.1208
No auth needed
Prerequisites: Softaculous and/or SitePad installed via Scripts Manager
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Lukas Johannes Möller, Egidio Romano · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb

This Metasploit module exploits an unauthenticated command injection vulnerability in Control Web Panel (CWP) via the 'key' parameter in /admin/index.php when 'api' is set. It supports both direct command execution and staged payload delivery.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Control Web Panel (CWP) <= 0.9.8.1208
No auth needed
Prerequisites: Softaculous and/or SitePad installed through Scripts Manager · Access to TCP port 2031
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Scores

CVSS v3 7.3
EPSS 0.0119
EPSS Percentile 63.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-78
Status published
Published May 08, 2026
Tracked Since Feb 18, 2026