Description

This exploit targets a command injection vulnerability in the hostapd.php script of RaspAP. The vulnerability exists due to improper sanitization of user input passed via the interface parameter. An authenticated attacker can inject arbitrary OS commands, resulting in code execution with the privileges of the www-data user.

Vulnerable Versions

• raspap-webgui ≤ 3.2.9

Requirements

• Python 3.x
• requests library installed
• Target running a vulnerable version of RaspAP
• Valid RaspAP login credentials

Usage

Parameters

• --base-url: Base URL of the RaspAP installation (e.g., http://192.168.122.22)
• --interface: Value for the interface parameter, injection payload allowed
• --username: RaspAP username (default: admin)
• --password: RaspAP password (default: secret)

Example

How it Works

1. The script authenticates to the RaspAP web interface using provided credentials.
2. It retrieves a valid CSRF token from the server.
3. A POST request is sent to hostapd.php with the interface parameter containing a malicious command injection payload.
4. The injected commands execute on the target system with www-data privileges.

Notes

• The exploit requires valid credentials.
• Successful exploitation allows arbitrary command execution, which can be chained for privilege escalation.

SmartTECS Cyber Security GmbH

SmartTECS Cyber Security GmbH is a cybersecurity company specializing in penetration testing, secure software development, and vulnerability research. The company provides tailored security assessments, incident response, and strategic advisory services to help organizations protect critical systems from evolving cyber threats.

Disclaimer

This tool is provided strictly for educational and research purposes. Use only on systems owned or administered with explicit permission. The author and SmartTECS Cyber Security GmbH assume no liability for misuse or damage.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-50428