ZPanel /etc/sudoers privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in ZPanel. This affects an unknown function of the file /etc/sudoers. Performing a manipulation results in privileges management. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is identified as CVE-2013-10052. The attack is only possible with local access. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in ZPanel (affected version unknown). This affects an unknown functionality of the file /etc/sudoers. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.

The weakness was released by sinn3r and Juan Vazquez. It is possible to read the advisory at raw.githubusercontent.com. This vulnerability is uniquely identified as CVE-2013-10052 since 08/01/2025. The exploitability is told to be easy. Attacking locally is a requirement. Technical details and a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (26451). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• ZPanel

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion