PT-2025-31689 · Zpanel · Zpanel

Published 2025-08-01 · Updated 2025-08-04 · CVE-2013-10053

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ZPanel version 10.0.0.2

Description A remote command execution issue exists in the htpasswd module. The inHTUsername field, when creating .htaccess files, is passed to a system() call without proper sanitization, which invokes the system’s htpasswd binary. An authenticated attacker can execute arbitrary system commands by injecting shell metacharacters into the username field. Exploitation requires a valid ZPanel account within the Users, Resellers, or Administrators groups, but does not require elevated privileges.

Recommendations Ensure the inHTUsername field is properly sanitized before being passed to the system() call when creating .htaccess files.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2013-10053

Affected Products

Zpanel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-10053 · Security Note
• https://github.com/zpanel/zpanelx · Note
• https://t.me/cveNotify/130798 · Telegram Post
• https://t.me/CVEtracker/28976 · Telegram Post
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/zpanel_username_exec.rb · Note
• https://vulncheck.com/advisories/zpanel-htpasswd-module-username-command-execution · Note
• https://web.archive.org/web/20130617014355/http://forums.zpanelcp.com/showthread.php?27898-Serious-Remote-Execution-Exploit-in-Zpanel-10-0-0-2 · Note