CVE Feed

    Dashboard / CVE / CVE-2022-44877

    CVE-2022-44877

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

    Published:Jan 5, 2023
    Last Modified:Nov 3, 2025
    EPS:Jan 5, 2023
    EPSS Score:0.94327
    CVSS Score:9.8

    CISA Notification

    Description

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Feb 7, 2023
    1312 days ago
    Alert Date
    Jan 17, 2023
    1333 days ago

    Affected Products

    Vendor
    Control-webpanel
    Product
    Webpanel

    Exploits

    http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2023/Jan/1https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386https://www.youtube.com/watch?v=kiLfSvc1SYYhttp://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2023/Jan/1https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386https://www.youtube.com/watch?v=kiLfSvc1SYYhttps://www.exploit-db.com/exploits/51194https://github.com/Chocapikk/CVE-2022-44877https://github.com/ColdFusionX/CVE-2022-44877-CWP7https://github.com/dkstar11q/CVE-2022-44877https://github.com/G01d3nW01f/CVE-2022-44877https://github.com/hotpotcookie/CVE-2022-44877-white-boxhttps://github.com/komomon/CVE-2022-44877-RCEhttps://github.com/numanturle/CVE-2022-44877https://github.com/rhymsc/CVE-2022-44877-RCEhttps://github.com/RicYaben/CVE-2022-44877-LABhttps://www.exploit-db.com/exploits/51250

    Related CVEs

    CVE-2025-48703 (CVSS 9) — CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution…
    CVE-2023-42123 (CVSS 8.8) — Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allo…
    CVE-2023-42122 (CVSS 7.8) — Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allow…
    CVE-2023-42121 (CVSS 9.8) — Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote…
    CVE-2023-42120 (CVSS 8.8) — Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability al…
    CVE-2021-45466 (CVSS 9.8) — In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to …
    CVE-2021-45467 (CVSS 9.8) — In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 …
    CVE-2022-25048 (CVSS 8.8) — Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.…
    CVE-2022-25047 (CVSS 5.9) — The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.…
    CVE-2022-25046 (CVSS 9.8) — A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via…

    References

    http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
    http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
    http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
    http://seclists.org/fulldisclosure/2023/Jan/1
    https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
    https://www.youtube.com/watch?v=kiLfSvc1SYY
    http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
    http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
    http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
    http://seclists.org/fulldisclosure/2023/Jan/1
    https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
    https://www.youtube.com/watch?v=kiLfSvc1SYY
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High