Summary
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.
Remediation
References
- Patchhttps://control-webpanel.com/changelog
- Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection
- Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor
- Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce