CVE-2021-45467

CRITICALNuclei

Control Web Panel (CWP), CentOS Web Panel Preauth Remote Code Execution

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-45467 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

webpanel

Browse control-webpanel / webpanel
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALControl Web Panel (CWP) - File InclusionCVSS 9.8

In CWP (Control Web Panel, previously CentOS Web Panel) before version 0.9.8.1107, an unauthenticated attacker can abuse null byte (%00) injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be exploited by using multiple %00 sequences to traverse directories via crafted requests such as /user/loader.php?api=1&scripts=.%00./.%00./api/account_new_create&acc=guadaapi, or similar payloads with more %00 instances (e.g., .%00%00%00./.%00%00%00./api/account_new_create). Attackers may use this flaw for arbitrary file access, privilege escalation, or remote code execution.

Impact

A remote, unauthenticated attacker can leverage this vulnerability to register arbitrary API keys, access sensitive files (such as /etc/passwd), and potentially achieve remote code execution. Successful exploitation results in full compromise of the web panel and host system, allowing for exposure of confidential data, server takeover, and further attacks on internal infrastructure.

Remediation

Update to version 0.9.8.1107 or later to fix input validation issues.

WeaknessesCWE-862
Authorsritikchaddha
Template tagscvecve2021cwprcelficentoswebpanelvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
FOFA: icon_hash="-356182173"
https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/ https://nvd.nist.gov/vuln/detail/CVE-2021-45467

Source: ProjectDiscovery

References

3