critical9.8Known exploitedPublic exploit code
CVE-2022-44877
CWP Control Web Panel OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-01-17. Federal due date: 2023-02-07.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)2023-04-05 · webapps · php
- Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)2023-04-01 · webapps · linux
Impact
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Control-Webpanel | Webpanel | before 0.9.8.1147 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2023/Jan/1
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
- https://www.youtube.com/watch?v=kiLfSvc1SYY
- http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2023/Jan/1
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
- https://www.youtube.com/watch?v=kiLfSvc1SYY
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877