Control Web Panel
Monthly
OS command injection in Control Web Panel (CWP) versions before 1.30 lets attackers who can reach the loopback-bound /valid_token/ API route run arbitrary commands as root by placing shell metacharacters in the unvalidated 'user' parameter, which is passed unescaped to shell_exec(). Reachability is the gating factor: the route is bound to the loopback interface, so exploitation requires local host access or an intermediary such as an SSRF primitive, a misconfigured reverse proxy, or a co-tenant process that can reach 127.0.0.1 - no authentication or user interaction is enforced once the endpoint is reachable. No public exploit code or CISA KEV entry is present in the available data; the vendor has published a fix in the 1.30 changelog and the vulnerability is tagged for remediation this week.
Control Web Panel (CWP) releases before webpanel_version 1.16 expose an OS command injection in the loopback /newpass/ password-change route, where the POST 'user' parameter is concatenated without escaping into a shell command that runs as root. Any party able to reach that route can execute arbitrary OS commands with root privileges; the supplied vectors indicate local/loopback access (AV:L, PR:N, UI:N), while a VulnCheck reference describes a pre-auth module-dispatch path that may bridge external requests to the loopback endpoint, making deployment-specific reachability the deciding factor. A vendor update to 1.16 is available, and a public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present.
Unauthenticated SQL injection in Control Web Panel (CWP) before webpanel_version 1.16 allows attackers who can reach the loopback API authentication gate access_token() to read arbitrary MySQL database contents and forge authentication results, bypassing the API's authentication check. The flaw is rated CVSS 8.5 (CVSS 4.0 AV:L/AC:L/PR:N/UI:N) and requires reaching the loopback/localhost interface, so local access or a pivot such as SSRF is needed; no public exploit identified at time of analysis.
OS command injection in Control Web Panel (CWP) versions before webpanel_version 1.30 lets an attacker who can reach the loopback-bound database restore API route /v1/restoredatabase/ run arbitrary operating system commands as root. The restoreDBBackup() handler takes an attacker-supplied file path from the POST body and passes it into a shell command without escaping, so shell metacharacters in that path are executed with the panel's root privileges. Exploitation is unauthenticated and requires no user interaction, but per the assessed vector (AV:L) the route is reachable only from the CWP host itself - a local account or process, or a chained path such as SSRF to 127.0.0.1 - rather than directly from the internet; no public exploit code was identified at time of analysis, and a vendor fix is available in version 1.30.
Missing authentication in the Control Web Panel (CWP) loopback API service allows anyone who can reach the localhost-bound API to invoke root-privileged routes - including /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/ - without presenting an access token, yielding high confidentiality, integrity and availability impact on the vulnerable host (CVSS 4.0 base 8.6, CWE-306, VC:H/VI:H/VA:H). CWP installations below webpanel_version 1.30 are affected, and the vendor fix is the 1.30 release. The gating factor is reachability: the vector is AV:L/PR:N/UI:N, so the attacker must be able to address the loopback listener (a local account, code execution on the host, or an SSRF/reverse-proxy path to 127.0.0.1); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry appears in the supplied data.
Unauthenticated OS command injection in Control Web Panel (CWP) builds prior to webpanel_version 1.16 lets remote attackers run arbitrary shell commands through the protected_directory user-panel module by posting a crafted 'file' parameter to the acc=deletedp action, which flows unsanitized into shell_exec. No credentials or user interaction are required against default installations, and the resulting commands execute in the user panel context. VulnCheck reported the issue and published a blog plus advisory describing it as a pre-auth module-dispatch RCE; only a public PoC reference exists (not verified as working exploit code), and no confirmed active exploitation is reported, though the act_now priority label, CVSS 9.3 severity and network-only attack path make rapid upgrade to 1.16 the clear action.
Remote code execution in Control Web Panel (CWP) installations running a webpanel_version earlier than 1.16 allows an authenticated user-panel account with access to the phpini_editor module to execute arbitrary OS commands and write files to attacker-chosen paths. Both abused actions are standard module functionality: acc=update feeds an attacker-supplied path into file_put_contents without confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec without escaping. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity and availability impact with PR:L, meaning a valid low-privileged panel credential is the gating prerequisite; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but a vendor patch exists and the finding is triaged as a this-week priority.
Authentication bypass in Control Web Panel (CWP) builds before webpanel_version 1.12 lets remote attackers who know a single valid hosting username reach user-panel module code paths without supplying a password, and the advisory describes this bypass as a step in a pre-authentication chain to root access. The root cause is an execution-after-redirect flaw (CWE-698): the user-panel authentication flow's unauthenticatedFlow() calls toLoginWithIntendedUri(), which emits a redirect header but never calls exit(), so PHP execution continues into the module dispatcher include unauthenticated. No public exploit was identified at time of analysis, but a vendor patch exists in 1.12 and the issue carries a 9.3 CVSS 4.0 score with PR:N, making it an act-now priority; the practical gating factor is that an attacker must first know or guess a valid tenant username, which is not a credential but is not anonymous either.
An authenticated low-privileged Control Web Panel (CWP) user can abuse path traversal in the module parameter handled by services/users/index.php to include arbitrary local .php files on installations running webpanel_version before 1.16. The module name is concatenated directly into a PHP include path with no allowlist, basename() call, or traversal filtering, so whether the flaw escalates to code execution depends on a local .php file whose contents the attacker can influence; no public exploit was identified at time of analysis. Exploitation requires a valid CWP session (PR:L) rather than being fully unauthenticated, and the vendor has released version 1.16 to close the issue, making this a genuine priority for the week rather than an emergency.
Unauthenticated blind SQL injection in Control Web Panel (CWP) before 0.9.8.1225 lets remote attackers inject arbitrary SQL through the userRes POST parameter of the user endpoint, and because CWP's MySQL connection runs with root privileges the flaw escalates to full remote code execution via INTO DUMPFILE. Attackers write a PHP webshell into the web-accessible roundcube logs directory and execute commands as the cwpsvc account. Publicly available exploit code exists and a vendor patch has been released; this is a network, no-authentication, low-complexity issue (CVSS 4.0 9.3).
Time-based blind SQL injection in Control Web Panel (CWP) releases prior to webpanel_version 1.30 allows an attacker who can reach an internal, loopback-bound API route - originally /user_panel_dashboard/, later /valid_token/ - to inject the 'user' parameter into a query executed against the oauth_clients table over a MySQL connection opened as root, then read arbitrary database contents by inferring data bit-by-bit. Because the route is bound to loopback rather than exposed publicly, reaching it requires local access to the server or an SSRF/relay primitive in another service; once that reachability exists, no authentication (PR:N) and no user interaction are required. The vendor changelog records a patch, and no public exploit was identified at time of analysis; the slow, inference-based extraction is the main reason this ranks as a this-month priority rather than an emergency despite a high confidentiality impact.
OS command injection in Control Web Panel (CWP) versions before 1.30 lets attackers who can reach the loopback-bound /valid_token/ API route run arbitrary commands as root by placing shell metacharacters in the unvalidated 'user' parameter, which is passed unescaped to shell_exec(). Reachability is the gating factor: the route is bound to the loopback interface, so exploitation requires local host access or an intermediary such as an SSRF primitive, a misconfigured reverse proxy, or a co-tenant process that can reach 127.0.0.1 - no authentication or user interaction is enforced once the endpoint is reachable. No public exploit code or CISA KEV entry is present in the available data; the vendor has published a fix in the 1.30 changelog and the vulnerability is tagged for remediation this week.
Control Web Panel (CWP) releases before webpanel_version 1.16 expose an OS command injection in the loopback /newpass/ password-change route, where the POST 'user' parameter is concatenated without escaping into a shell command that runs as root. Any party able to reach that route can execute arbitrary OS commands with root privileges; the supplied vectors indicate local/loopback access (AV:L, PR:N, UI:N), while a VulnCheck reference describes a pre-auth module-dispatch path that may bridge external requests to the loopback endpoint, making deployment-specific reachability the deciding factor. A vendor update to 1.16 is available, and a public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present.
Unauthenticated SQL injection in Control Web Panel (CWP) before webpanel_version 1.16 allows attackers who can reach the loopback API authentication gate access_token() to read arbitrary MySQL database contents and forge authentication results, bypassing the API's authentication check. The flaw is rated CVSS 8.5 (CVSS 4.0 AV:L/AC:L/PR:N/UI:N) and requires reaching the loopback/localhost interface, so local access or a pivot such as SSRF is needed; no public exploit identified at time of analysis.
OS command injection in Control Web Panel (CWP) versions before webpanel_version 1.30 lets an attacker who can reach the loopback-bound database restore API route /v1/restoredatabase/ run arbitrary operating system commands as root. The restoreDBBackup() handler takes an attacker-supplied file path from the POST body and passes it into a shell command without escaping, so shell metacharacters in that path are executed with the panel's root privileges. Exploitation is unauthenticated and requires no user interaction, but per the assessed vector (AV:L) the route is reachable only from the CWP host itself - a local account or process, or a chained path such as SSRF to 127.0.0.1 - rather than directly from the internet; no public exploit code was identified at time of analysis, and a vendor fix is available in version 1.30.
Missing authentication in the Control Web Panel (CWP) loopback API service allows anyone who can reach the localhost-bound API to invoke root-privileged routes - including /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/ - without presenting an access token, yielding high confidentiality, integrity and availability impact on the vulnerable host (CVSS 4.0 base 8.6, CWE-306, VC:H/VI:H/VA:H). CWP installations below webpanel_version 1.30 are affected, and the vendor fix is the 1.30 release. The gating factor is reachability: the vector is AV:L/PR:N/UI:N, so the attacker must be able to address the loopback listener (a local account, code execution on the host, or an SSRF/reverse-proxy path to 127.0.0.1); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry appears in the supplied data.
Unauthenticated OS command injection in Control Web Panel (CWP) builds prior to webpanel_version 1.16 lets remote attackers run arbitrary shell commands through the protected_directory user-panel module by posting a crafted 'file' parameter to the acc=deletedp action, which flows unsanitized into shell_exec. No credentials or user interaction are required against default installations, and the resulting commands execute in the user panel context. VulnCheck reported the issue and published a blog plus advisory describing it as a pre-auth module-dispatch RCE; only a public PoC reference exists (not verified as working exploit code), and no confirmed active exploitation is reported, though the act_now priority label, CVSS 9.3 severity and network-only attack path make rapid upgrade to 1.16 the clear action.
Remote code execution in Control Web Panel (CWP) installations running a webpanel_version earlier than 1.16 allows an authenticated user-panel account with access to the phpini_editor module to execute arbitrary OS commands and write files to attacker-chosen paths. Both abused actions are standard module functionality: acc=update feeds an attacker-supplied path into file_put_contents without confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec without escaping. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity and availability impact with PR:L, meaning a valid low-privileged panel credential is the gating prerequisite; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but a vendor patch exists and the finding is triaged as a this-week priority.
Authentication bypass in Control Web Panel (CWP) builds before webpanel_version 1.12 lets remote attackers who know a single valid hosting username reach user-panel module code paths without supplying a password, and the advisory describes this bypass as a step in a pre-authentication chain to root access. The root cause is an execution-after-redirect flaw (CWE-698): the user-panel authentication flow's unauthenticatedFlow() calls toLoginWithIntendedUri(), which emits a redirect header but never calls exit(), so PHP execution continues into the module dispatcher include unauthenticated. No public exploit was identified at time of analysis, but a vendor patch exists in 1.12 and the issue carries a 9.3 CVSS 4.0 score with PR:N, making it an act-now priority; the practical gating factor is that an attacker must first know or guess a valid tenant username, which is not a credential but is not anonymous either.
An authenticated low-privileged Control Web Panel (CWP) user can abuse path traversal in the module parameter handled by services/users/index.php to include arbitrary local .php files on installations running webpanel_version before 1.16. The module name is concatenated directly into a PHP include path with no allowlist, basename() call, or traversal filtering, so whether the flaw escalates to code execution depends on a local .php file whose contents the attacker can influence; no public exploit was identified at time of analysis. Exploitation requires a valid CWP session (PR:L) rather than being fully unauthenticated, and the vendor has released version 1.16 to close the issue, making this a genuine priority for the week rather than an emergency.
Unauthenticated blind SQL injection in Control Web Panel (CWP) before 0.9.8.1225 lets remote attackers inject arbitrary SQL through the userRes POST parameter of the user endpoint, and because CWP's MySQL connection runs with root privileges the flaw escalates to full remote code execution via INTO DUMPFILE. Attackers write a PHP webshell into the web-accessible roundcube logs directory and execute commands as the cwpsvc account. Publicly available exploit code exists and a vendor patch has been released; this is a network, no-authentication, low-complexity issue (CVSS 4.0 9.3).
Time-based blind SQL injection in Control Web Panel (CWP) releases prior to webpanel_version 1.30 allows an attacker who can reach an internal, loopback-bound API route - originally /user_panel_dashboard/, later /valid_token/ - to inject the 'user' parameter into a query executed against the oauth_clients table over a MySQL connection opened as root, then read arbitrary database contents by inferring data bit-by-bit. Because the route is bound to loopback rather than exposed publicly, reaching it requires local access to the server or an SSRF/relay primitive in another service; once that reachability exists, no authentication (PR:N) and no user interaction are required. The vendor changelog records a patch, and no public exploit was identified at time of analysis; the slow, inference-based extraction is the main reason this ranks as a this-month priority rather than an emergency despite a high confidentiality impact.