CVE-2021-45467

What it actually does

CVE-2021-45467 is an unauthenticated authentication bypass in Control Web Panel before version 0.9.8.1107. The vulnerable /user/loader.php endpoint mishandles URL-encoded null bytes in the scripts parameter, allowing an attacker to route execution to API functionality such as /api/account_new_create without a valid session or existing API credential. Successful exploitation can allow registration or use of an attacker-controlled API key and subsequent privileged API actions, resulting in full compromise of confidentiality, integrity, and availability of the web hosting control panel and managed services.

Why it matters to the business

An internet-exposed vulnerable Control Web Panel instance can be taken over remotely without credentials. Because CWP commonly manages websites, mail, DNS, databases, and hosting accounts, compromise can lead to website defacement, malware hosting, data theft, unauthorized account creation, service disruption, spam campaigns, and loss of administrative control. The CVSS score is critical, EPSS is high at approximately 0.71, and exploit maturity is weaponized, so organizations should treat exposed systems as high-priority even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker scans for internet-facing Control Web Panel installations and identifies hosts running a version older than 0.9.8.1107. The attacker sends a crafted unauthenticated request to /user/loader.php with api=1 and a scripts parameter containing one or more %00 null-byte sequences combined with a relative path to an API action, such as api/account_new_create. Due to improper handling of null bytes and script path resolution, the request reaches API functionality that should require prior authentication. The attacker can then register or use an arbitrary API key or create a new account, gaining a foothold in the control panel. After that, the attacker uses the API or panel functionality to create hosting users, upload malicious content or web shells, modify hosted sites, access mail or database configuration, create persistence, and potentially disrupt services.

How to fix it

Upgrade Control Web Panel to version 0.9.8.1107 or later. If immediate upgrade is not possible, restrict access to CWP administrative and user panel endpoints to trusted management IP addresses, place the panel behind VPN or zero-trust access controls, and block requests to /user/loader.php that contain api=1, scripts=, %00, or references to api/account_new_create. Rotate CWP API keys and administrative credentials after patching, especially if the instance was internet-facing. Review and remove unauthorized panel users, hosting accounts, API keys, cron jobs, uploaded files, and configuration changes. Ensure web server, cwpsrv, and application logs are retained before remediation so exploitation evidence is not lost.

How to confirm the fix worked

Confirm the installed Control Web Panel version is 0.9.8.1107 or later. From an unauthenticated network position, verify that crafted requests to /user/loader.php with api=1, scripts containing %00, and paths referencing /api/account_new_create are rejected and do not create accounts, API keys, or server-side changes. Review CWP user, account, and API key inventories for unauthorized entries created before the patch. Validate that administrative panel access is restricted to approved networks or access controls. Check web access logs to ensure no successful 200/3xx responses were returned for suspicious /user/loader.php requests containing null-byte encoded script paths.

Typical attack path

1. Identify internet-facing Control Web Panel services through scanning, banners, login pages, or known CWP paths.
2. Confirm the target is running a version before 0.9.8.1107 or appears unpatched.
3. Send an unauthenticated request to /user/loader.php with api=1 and a crafted scripts parameter containing URL-encoded null bytes such as %00.
4. Route execution to an API endpoint such as /api/account_new_create by abusing the malformed scripts path.
5. Register or use an attacker-controlled API key or create an unauthorized account.
6. Use the newly obtained access to perform privileged CWP actions, including account creation, file upload, configuration changes, or service manipulation.
7. Establish persistence through new panel users, API keys, hosted web shells, cron jobs, or modified website content.
8. Exfiltrate data, abuse hosted services, or disrupt websites, mail, DNS, or databases managed by the panel.

How to detect it

To determine whether exploitation already occurred, review web server, reverse proxy, WAF, and Control Web Panel/cwpsrv access logs for unauthenticated requests to /user/loader.php that include api=1 and a scripts parameter containing %00 null-byte encodings or references to api/account_new_create. Pay particular attention to requests returning HTTP 200, 201, 302, or other non-error responses, and correlate those timestamps with newly created CWP accounts, API keys, hosting users, file uploads, DNS/mail/database changes, and cron modifications. Search for multiple variations of encoded null bytes because the exploit can use any number of %00 instances. Investigate source IPs that sent the suspicious request and then accessed panel, FTP, SSH, webmail, or hosted website paths shortly afterward. On the host, review CWP account inventories, API key listings, recently modified web roots, recently created PHP files, suspicious scheduled tasks, and unexpected processes spawned by web service or panel service accounts. If exploitation is suspected, assume panel credentials and API keys may be compromised and perform credential rotation plus a full integrity review of managed sites and services.

• /user/loader.php?api=1
• /user/loader.php
• api=1&scripts=
• scripts=.%00
• %00./.%00
• %00%00%00
• /api/account_new_create
• api/account_new_create
• scripts=.%00./.%00./api/account_new_create
• scripts=.%00%00%00./.%00%00%00./api/account_new_create
• acc=guadaapi
• GET /user/loader.php?api=1
• POST /user/loader.php?api=1

What your security team should do

• Patch all Control Web Panel installations to 0.9.8.1107 or later immediately, prioritizing internet-facing systems.
• If patching cannot be completed immediately, restrict CWP access to trusted IP ranges or VPN-only access and deploy WAF or reverse-proxy rules blocking null-byte requests to /user/loader.php.
• Search historical web, cwpsrv, proxy, and WAF logs for /user/loader.php requests containing api=1, scripts=, %00, account_new_create, or repeated encoded null bytes.
• Rotate all CWP API keys and administrative credentials after patching if the panel was exposed to the internet.
• Audit CWP accounts, hosting users, API keys, cron jobs, uploaded files, virtual hosts, DNS records, mail settings, and database users for unauthorized changes.
• Look for post-exploitation artifacts such as newly created hosting accounts, unexpected PHP files, web shells, outbound spam, unusual process execution by web service users, and modified website content.
• Increase monitoring on affected servers for suspicious API usage, new account creation, file uploads, and access to sensitive hosted data.
• Preserve logs and filesystem evidence before rebuilding or cleaning systems where exploitation is suspected.