CVE-2022-44877 : login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Published 2023-01-05 23:15:09

Updated 2023-04-06 17:15:10

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-44877

Control-webpanel » Webpanel
Versions before (<) 0.9.8.1147
cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
Matching versions

CVE-2022-44877 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

CWP Control Web Panel OS Command Injection Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Notes:

https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877

Added on 2023-01-17 Action due date 2023-02-07

Exploit prediction scoring system (EPSS) score for CVE-2022-44877

EPSS FAQ

97.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-44877

CWP login.php Unauthenticated RCE

Disclosure Date: 2023-01-05

First seen: 2023-09-11

exploit/linux/http/control_web_panel_login_cmd_exec

Control Web Panel versions < 0.9.8.1147 are vulnerable to unauthenticated OS command injection. Successful exploitation results in code execution as the root user. The results of the command are not contained within the HTTP response and the request will bloc

More information

CVSS scores for CVE-2022-44877

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-44877

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-44877

http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html

Control Web Panel Unauthenticated Remote Command Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386

# Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877 · GitHub
Exploit;Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/1

Full Disclosure: Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877
Exploit;Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html

Control Web Panel 7 (CWP7) 0.9.8.1147 Remote Code Execution ≈ Packet Storm
https://www.youtube.com/watch?v=kiLfSvc1SYY

Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877 - YouTube
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html

Control Web Panel 7 Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2022-44877