CVE-2025-48703 PoC — Control Web Panel 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48703.yaml

Associated Vulnerability

Title:Control Web Panel 操作系统命令注入漏洞 (CVE-2025-48703)
Description:Control Web Panel是一款Linux虚拟主机控制面板。 Control Web Panel 0.9.8.1205之前版本存在操作系统命令注入漏洞，该漏洞源于filemanager changePerm请求中t_total参数包含shell元字符，可能导致远程代码执行。

Description

CWP (Control Web Panel) < 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the t_total parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username.

File Snapshot


 id: CVE-2025-48703

info:
  name: CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution
  aut

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!