From Digibase Knowledge Base
Jump to: navigation, search

DBSA ID: 2013-0001

Regarding: zPanel security practices

Writeup: Kradorex Xeron (talk) 18:11, 15 May 2013 (EDT)

Date: 2013 05 15

Last Modified: 20130515213040 by Kradorex Xeron

Who should take note: System Administrators, Web Hosting Operators, Web Hosting Resellers



Rationale: Hosts and other web platforms utilizing zPanel should migrate away from zPanel as soon as possible.

Severity: MEDIUM

Rationale: Exploits are left unpatched, even if reported to the development team.


Rationale: zPanel operates on Windows and Linux platforms, though considering other control panel suites are more common, spread is considered low.


zPanel is a system and hosting administration control panel, this software is open source and targeted toward hosting companies and economical small and medium sized project hosting.

The project recently had an incident <ref name="Ref01">http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/</ref> where a researcher/user proceeded to report an exploit to the vendor. A representative of the vendor proceeded to disclaim the possibility that vulnerabilities exist in the zPanel platform after review by a consultant. Additionally, the vendor challenged the reporter to penetrate into their servers and in the process insulted and otherwise was highly unprofessional to the reporter. The exploit and associated exploits were successfully utilized to penetrate, and compromise the vendors' servers.

Technical Details

The vendor's website is http://www.zpanelcp.com. As of this advisory, the vendor's site is inaccessable.


It is strongly advised that zPanel's software suite be avoided and that those currently utilizing it migrate to other management platforms considering the vendor's approach to security.