PT-2022-6101 · Unknown · Control Web Panel

Numan Turle · Published 2022-10-25 · Updated 2026-04-13 · CVE-2022-44877

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1147

Description The issue is related to the login/index.php component in Control Web Panel, which allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter. This can be exploited by sending specially crafted HTTP requests. The vulnerability is under active exploit and has a high severity rating.

Recommendations For Control Web Panel versions prior to 0.9.8.1147, update to version 0.9.8.1147 or later to resolve the issue. As a temporary workaround, consider restricting access to the login/index.php component until a patch is applied. Avoid using the login parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00039

CVE-2022-44877

Affected Products

Control Web Panel

References · 39

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_login_cmd_exec.rb · Exploit
• 🔥 https://github.com/numanturle/CVE-2022-44877 · Exploit
• 🔥 https://github.com/komomon/CVE-2022-44877-RCE · Exploit
• 🔥 https://github.com/hotpotcookie/CVE-2022-44877-white-box · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-44877 · Exploit
• 🔥 https://exploit-db.com/exploits/51250 · Exploit
• 🔥 https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386 · Exploit
• 🔥 https://youtube.com/watch?v=kiLfSvc1SYY · Exploit
• 🔥 https://exploit-db.com/exploits/51194 · Exploit
• 🔥 http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Jan/1 · Exploit
• 🔥 http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-44877 · Vendor Advisory
• https://control-webpanel.com/changelog#1669855527714-450fb335-6194 · Security Note