CVE-2022-44877

EUVD-2022-47807
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
control-webpanelwebpanel
𝑥
< 0.9.8.1147
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Jan/1
https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
https://www.youtube.com/watch?v=kiLfSvc1SYY
http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Jan/1
https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
https://www.youtube.com/watch?v=kiLfSvc1SYY
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877