1Panel Exploitation Skill
1Panel is a web-based Linux server management control panel. This skill covers four types of exploitation methods,
from unauthenticated RCE to file reading.
Target Information
- Product: 1Panel (Linux server management panel)
- Default Port: 10086 (configurable)
- Default Credentials：
1panel / 1panel_password
- Default Entry Path：
/entrance(configurable, may be hidden)
- Tech Stack: Go backend, SQLite database, Vue frontend, OpenResty reverse proxy
Vulnerability Overview
| CVE |
Type |
Authentication Requirement |
Impact |
Severity Level |
| CVE-2025-54424 |
Client certificate bypass + WebSocket terminal |
No authentication required (mTLS bypass) |
Interactive RCE |
Critical |
| CVE-2024-39911 |
User-Agent SQL injection |
No authentication required (frontend) |
RCE (write PHP Webshell) |
Critical |
| CVE-2024-39907 |
Backend API SQL injection |
Requires Session Cookie |
Arbitrary file write/RCE |
High |
| N/A |
loadfile file read |
Requires backend Session |
Arbitrary file read |
High |
Attack Decision Tree
已识别目标为 1Panel？
├── 开启 HTTPS 且 WebSocket 端点可访问？
│ └── 使用 CVE-2025-54424 脚本（无需认证，交互式 Shell）
├── OpenResty 开启了 WAF/监控功能？
│ └── 使用 CVE-2024-39911（User-Agent 注入，无需认证）
├── 有有效 Session Cookie 或默认凭据？
│ ├── 使用 CVE-2024-39907（orderBy 注入，文件写入）
│ └── 使用 loadfile 文件读取（路径遍历）
└── 不确定？先从 CVE-2025-54424 扫描开始
Quick Reference Table
| Scenario |
Method |
Key Command/Endpoint |
| No authentication + HTTPS |
CVE-2025-54424 |
python3 scripts/CVE-2025-54424.py -u host:port |
| No authentication + OpenResty |
CVE-2024-39911 |
User-Agent injection ATTACH DATABASE write Webshell |
| Has Session |
CVE-2024-39907 |
POST /api/v1/hosts/command/search orderBy injection |
| Has Session |
File read |
GET /systemController/showOrDownByurl.do?dbPath=../../../../../etc/passwd |
Detailed Reference Documentation
