Path Traversal in Control Web Panel Before 1.16

Executive Summary

Control Web Panel (CWP) before version 1.16 has a path traversal vulnerability in services/users/index.php. An attacker can supply directory traversal sequences in the module name parameter, which is directly concatenated into an include path without sanitization. This allows arbitrary local PHP files to be included, leading to local PHP file inclusion.

Useful 0 Not Useful 0

Detection Guidance

Check for vulnerable CWP versions by running: rpm -qa | grep cwp. If the version is below 1.16, the system is likely vulnerable. Inspect the file /usr/local/cwpsrv/htdocs/resources/admin/modules/users/index.php for path traversal patterns in module names.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary PHP code on the server. This could lead to full system compromise, unauthorized data access, installation of malware, or further network infiltration. The high CVSS scores indicate significant risk of confidentiality, integrity, and availability impacts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to CWP version 1.16 or later immediately. If upgrading is not possible, restrict access to the vulnerable file by modifying server permissions or using a web application firewall to block directory traversal attempts.

Useful 0 Not Useful 0