by Kastro
Paper/Archive/CVE-2022-44877

CVE-2022-44877

CWP Control Web Panel — CWP Control Web Panel OS Command Injection Vulnerability

KEV · due 7 FebEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refyoutube.com/watch?v=kiLfSvc1SYYrefgist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386refseclists.org/fulldisclosure/2023/Jan/1refpacketstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.htmlrefpacketstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877kevcisa.gov/known-exploited-vulnerabilities-catalog