Control Web Panelに任意コード実行の脆弱性、1.16で修正
Summary
ホスティング用の管理パネルControl Web Panelに、任意のファイル書き込みとOSコマンド実行につながる脆弱性が見つかりました。1.16より前を使う組織は、修正版への更新と、パネルへのアクセス制限の確認を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
ホスティング用の管理パネルControl Web Panelに、任意のファイル書き込みとOSコマンド実行につながる脆弱性が見つかりました。1.16より前を使う組織は、修正版への更新と、パネルへのアクセス制限の確認を進めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
< 1.16 |
1.16 |
Original description The description as published by the source.
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web control-webpanel.com
- web vulncheck.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com