CentOS Web Panel Permissions License and Access Control Issues Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A privilege permission and access control issue vulnerability exists in CentOS Web Panel version 0.9.8.851, which can be exploited by an attacker to delete arbitrary databases...

CentOS Web Panel Information Disclosure Vulnerability (CNVD-2019-41837)

CentOS Web Panel CWP is a free web hosting control panel. An information disclosure vulnerability exists in CentOS Web Panel version 0.9.8.848, which can be exploited by an attacker to check the validity of a user's name by comparing response times...

CentOS-WebPanel.com Control Web Panel (CWP) 0.9.8.851 phpMyAdmin Password Change

Exploit Title : CWP CentOS Control Web Panel Reset other phpMyadmin password Date : 24 Jul 2019 Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, user panel only available for lastest...

CentOS Control Web Panel 0.9.8.840 User Enumeration Vulnerability

Exploit for linux platform in category web applications Exploit Title: CWP CentOS Control Web Panel User Enumeration Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.836 to 0.9.8.840 Tested on: CentOS...

CentOS-WebPanel.com Control Web Panel 0.9.8.836 Remote Command Execution

Exploit Title: CWP CentOS Control Web Panel 0.9.8.836 - Remote Command Execution Date: 6 July 2019 Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.836 Tested on: CentOS 7.6.1810 Core CVE : CVE-2019-133...

CentOS-WebPanel.com Control Web Panel 0.9.8.846 Cross Site Scripting

Exploit Title: CWP CentOS Control Web Panel Reflected Cross Site Scripting Date: 23 July 2019 Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.846 Tested on: CentOS 7.6.1810 Core FireFox 68.0.1 64-bit C...

CentOS Web Panel Command Execution Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.846. The vulnerability can be exploited by an attacker to directly execute operating system commands with the help of a web browser...

CentOS Web Panel Cross-Site Scripting Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A cross-site scripting vulnerability exists in the filemanager2.php file the 'fmcurrentdir' parameter in CWP version 0.9.8.846. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can...

CentOS Web Panel Information Disclosure Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. An information disclosure vulnerability exists in CWP version 0.9.8.840. The vulnerability stems from errors such as configuration during operation of a networked system or product. An unauthorized attacker could exploit the vulnerability ...

CVE-2019-13385

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log...

CVE-2019-13386

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege...

CVE-2019-13386

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege...

CVE-2019-13387

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php parameter fmcurrentdir allows attackers to steal a cookie or session, or redirect to a phishing website...

CVE-2019-13386

CVE-2019-13386 affects CentOS Web Panel (CWP) version 0.9.8.846. A hidden action=9 in filemanager2.php enables an attacker to execute shell commands, potentially obtaining a reverse shell with the user’s privileges. Exploitation details and references across multiple sources corroborate this remo...

CVE-2019-13385

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log...

PT-2019-13305 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: A hidden feature in the filemanager2.php file allows attackers to execute shell commands, potentially obtaining a reverse shell with user privileges. Recommendations: For version 0.9.8.846,...

PT-2019-13304 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.840 Description: The issue allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log, potentially exposing file and directory information. Recommendations: For...

PT-2019-13306 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: The issue allows attackers to steal a cookie or session, or redirect to a phishing website through Reflected XSS in the filemanager2.php file, specifically targeting the fm current dir parameter...

CentOS Web Panel Information Disclosure Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.846. An attacker can exploit the vulnerability by reading the HTTP response to check for a valid username...

CentOS Web Panel Authorization Issues Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.836. During login, a remote attacker can exploit this vulnerability to bypass authentication with the help of a valid username...