CVE-2025-67888: Unauthenticated Root RCE in Control Web Panel (CWP)

Published: June 2026
Category: Security Advisory
Severity: Critical
Affected Software: Control Web Panel (CWP) < 0.9.8.1209
Impact: Unauthenticated Remote Code Execution as Root
CWE: CWE-78 (OS Command Injection)

Overview

CVE-2025-67888 is a critical pre-authentication command injection vulnerability affecting Control Web Panel (CWP) installations running versions prior to 0.9.8.1231.

The flaw exists within the CWP administrative API endpoint:

/admin/index.php

When the api parameter is enabled, user-controlled input supplied through the key parameter is passed to an operating system command without proper sanitization. An attacker can inject arbitrary shell commands which are executed by the CWP service running with root privileges. Successful exploitation results in full server compromise without requiring authentication. Exploitation requires either Softaculous or SitePad to be installed through the Scripts Manager.

Technical Analysis

Vulnerable Request Path

GET /admin/index.php?api=1&key=<payload>

Affected versions process the key parameter in an unsafe execution context.

The vulnerability can be classified as:

OS Command Injection
Privilege Escalation: N/A
Authentication Required: No
User Interaction: None
Execution Context: root

The underlying issue is failure to neutralize shell metacharacters before invoking OS-level command execution routines. Shell operators such as:

;
|
&
$()
`

may be interpreted by the shell and allow attacker-controlled command execution.

Attack Chain

A realistic attack scenario looks like:

Internet
   │
   ▼
CWP Port 2030/2031
   │
   ▼
/admin/index.php?api=1
   │
   ▼
Unsanitized key parameter
   │
   ▼
OS Command Execution
   │
   ▼
Root Shell
   │
   ▼
Persistence + Malware Deployment

Potential post-exploitation activities include:

Because CWP services commonly run as root, successful exploitation immediately yields unrestricted system control.

Exposure Assessment

Determine if Softaculous or SitePad is installed:

rpm -qa | egrep 'softaculous|sitepad'

Verify installed CWP version:

cat /usr/local/cwpsrv/htdocs/resources/admin/include/version.txt

or

grep VERSION /usr/local/cwpsrv/htdocs/resources/admin/include/version.php

Any version below:

0.9.8.1231

should be considered vulnerable.

Threat Hunting Indicators

Review access logs for requests containing:

api=1

combined with suspicious shell characters:

;
|
$(
`
&

Example:

grep -R "api=1" /usr/local/cwpsrv/logs/ \
| egrep ";|\||\$\( |`|&"

Look for suspicious outbound downloads:

grep -R "wget\|curl\|bash -c" \
/usr/local/cwpsrv/logs/

Search for unexpected shell execution:

journalctl -xe | egrep "sh|bash|wget|curl"

SentinelOne and other threat intelligence sources specifically recommend monitoring requests targeting /admin/index.php containing both api and key parameters.

Production Security Audit Script

The following script was designed for managed hosting environments and performs:

Save as:

/root/cwp-cve-2025-67888-audit.sh

Audit Script

#!/bin/bash

REPORT="/root/cwp_audit_$(date +%F_%H%M).txt"

exec > >(tee -a "$REPORT") 2>&1

echo "=========================================="
echo " CVE-2025-67888 Incident Response Audit"
echo "=========================================="
echo

echo "[1] Host Information"
hostnamectl

echo
echo "[2] CWP Version"
find /usr/local/cwpsrv -name version.txt -exec cat {} \; 2>/dev/null

echo
echo "[3] Softaculous / SitePad"
rpm -qa | egrep 'softaculous|sitepad'

echo
echo "[4] Listening Services"
ss -tulpn

echo
echo "[5] Recently Modified Files (<7 Days)"
find /home /var/www /usr/local/cwpsrv \
-type f -mtime -7 2>/dev/null

echo
echo "[6] Hidden PHP Files"
find / -type f \
\( -name ".php" -o \
   -name ".r.php" -o \
   -name "shell.php" -o \
   -name "cmd.php" \) 2>/dev/null

echo
echo "[7] Authorized Keys"
find / -path "*/.ssh/authorized_keys" 2>/dev/null

echo
echo "[8] Root Logins"
grep "Accepted" /var/log/secure* 2>/dev/null | grep root

echo
echo "[9] New Users"
awk -F: '$3 >= 1000 {print $1,$3,$6}' /etc/passwd

echo
echo "[10] Cron Jobs"
for u in $(cut -d: -f1 /etc/passwd); do
    crontab -u "$u" -l 2>/dev/null
done

echo
echo "[11] Malware Functions"
grep -R \
--include="*.php" \
-nE 'eval\(|base64_decode|shell_exec|passthru|system\(|proc_open' \
/home 2>/dev/null

echo
echo "[12] Recently Created Systemd Services"
find /etc/systemd \
-type f \
-mtime -30

echo
echo "[13] Suspicious Network Connections"
ss -tpna

echo
echo "[14] Auditd Login Events"
ausearch -m USER_LOGIN 2>/dev/null | tail -50

echo
echo "Report saved to:"
echo "$REPORT"

Emergency Mitigation

If patching cannot be performed immediately:

Restrict CWP Access

CSF Example:

csf -d 0.0.0.0/0 2030
csf -d 0.0.0.0/0 2031

csf -a YOUR_OFFICE_IP
csf -r

Nginx Reverse Proxy Protection

location = /admin/index.php {
    if ($args ~* "api=.*key=.*[;|`$()&]") {
        return 403;
    }
}

Block Direct Internet Access

Only allow:

VPN
Office IPs
Jump Hosts

Recommended Incident Response Actions

If exploitation is suspected:

  1. Disconnect the server from public networks.

  2. Capture volatile evidence.

  3. Export:

  4. Review all SSH authorized keys.

  5. Review all cron jobs and systemd services.

  6. Scan user home directories for web shells.

  7. Rotate:

  8. Rebuild the server if root-level compromise is confirmed.

For hosting providers, the safest approach after confirmed exploitation is typically a full rebuild followed by restoration of verified clean backups.

⚠️ Important: This script should only be executed on a fresh installation or a trusted clean server. It will modify SSH configuration, firewall rules, and security services. If the server is already suspected to be compromised, perform forensic analysis before execution.

curl -fsSL https://wiki.back2cloud.com/scripts/cwp-hardening.sh | bash -s -- --auto

References

SentinelOne Vulnerability Database
(SentinelOne)

Karma(In)Security Advisory KIS-2025-09
(archive.ph)

NVD / CVE Details
(cve.imfht.com)