Control Web Panel user panel login bypass via execution after redirect
Web hosting control panel lets anyone in without logging in.
Summary
Control Web Panel (CWP) keeps running PHP code after its login redirect, so an unauthenticated attacker can reach features that should require a login. Versions before 1.12 are affected.
Affected when
- User panel on port 2083 reachable from the network
What to do
Update Control Web Panel to 1.12 or later. VulnCheck recommends 1.29 or later.
Products and platforms
CVE IDs
Sources
- Advisory: control-webpanel.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen