CVE-2022-25046

What it actually does

This is an unauthenticated, network-exploitable path traversal vulnerability in Control Web Panel (CWP) v0.9.8.1122 affecting loader.php. A crafted POST request can cause the application to resolve attacker-controlled paths outside the intended directory boundary, which can be abused to execute arbitrary code. Successful exploitation can provide command execution in the context of the web panel service or associated web server user, with potential access to hosted site files, configuration data, credentials, and administrative functions exposed by the panel.

Why it matters to the business

Compromise of a Control Web Panel server can lead to loss of control over hosted websites, theft of credentials and customer data, website defacement, malware hosting, spam campaigns, service outages, and potential lateral movement into adjacent infrastructure. The risk is high because exploitation is remote, requires no authentication or user interaction, has public exploit availability, and has a high EPSS likelihood, meaning internet-facing unpatched systems should be treated as likely targets even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker typically identifies an internet-facing Control Web Panel instance and checks whether loader.php is reachable. They then send a specially crafted POST request containing path traversal sequences that cause the application to reference files or execution paths outside the expected web application directory. If the vulnerable version is present, the request can result in arbitrary code execution on the server. After initial code execution, the attacker may establish persistence by dropping a web shell, creating or modifying accounts, changing scheduled tasks, adding SSH keys, or deploying malware. They may then collect panel configuration files, database credentials, mail credentials, hosted website content, and use the server for further attacks such as phishing, spam, cryptomining, or pivoting to other systems.

How to fix it

Upgrade Control Web Panel to a current vendor-supported release newer than v0.9.8.1122. Because no exact fixed version is provided in the input, organizations should consult the Control Web Panel vendor advisory or release notes and apply the latest available stable update rather than attempting a minimal version jump. Restrict public access to the CWP administrative interface and loader.php where possible using VPN, allowlists, firewall rules, or reverse-proxy access controls. Add WAF or web server rules to block POST requests to loader.php containing traversal sequences such as ../, ..%2f, %2e%2e%2f, or similar encodings. If exploitation is suspected, do not rely on patching alone: preserve evidence, remove attacker persistence, rotate credentials stored on or managed by the panel, review hosted site files for web shells, and rebuild from a trusted image if system integrity cannot be verified.

How to confirm the fix worked

Confirm the installed Control Web Panel version is newer than v0.9.8.1122 or otherwise documented by the vendor as fixed. Verify that the CWP administrative interface is not broadly exposed to the internet unless explicitly required and protected by strong access controls. Review web server, CWP, and reverse-proxy logs to confirm that POST requests to loader.php with traversal patterns are blocked or return non-success responses. Perform a safe, non-destructive validation using an approved scanner or controlled request containing benign traversal markers and confirm it does not read, include, write, or execute unintended files. Validate that WAF/firewall controls alert on encoded and double-encoded traversal attempts. After remediation, run file integrity checks across CWP web directories and hosted website roots to confirm no unauthorized files remain.

Typical attack path

1. Scan for internet-facing Control Web Panel instances and exposed CWP service ports.
2. Confirm that the target appears to be a vulnerable CWP version at or around v0.9.8.1122.
3. Send a crafted unauthenticated POST request to loader.php containing directory traversal patterns.
4. Trigger unintended file access or code execution through the vulnerable loader.php path handling.
5. Execute commands under the CWP/web server service context.
6. Deploy a web shell, backdoor, cron job, SSH key, or other persistence mechanism.
7. Harvest configuration files, credentials, hosted website data, and administrative panel information.
8. Use the compromised server for follow-on activity such as malware hosting, spam, credential theft, or lateral movement.

How to detect it

Review CWP/cwpsrv access logs, web server access and error logs, reverse-proxy logs, WAF events, EDR telemetry, shell command history, process execution logs, cron/systemd changes, authentication logs, and file integrity monitoring data. Focus on unauthenticated POST requests to loader.php, especially requests containing path traversal strings, URL-encoded traversal, double-encoded traversal, null-byte encodings, shell metacharacters, or attempts to reference sensitive files. Investigate successful HTTP 200/3xx responses, unusually large responses, 500 errors followed by new files, and requests followed by outbound connections from the server. On the host, look for recently created or modified PHP files in CWP and hosted website directories, suspicious files with image-like names but PHP content, unexpected web shells, new cron jobs, modified authorized_keys files, new local users, and processes spawned by the web panel or web server user such as sh, bash, curl, wget, python, perl, php, nc, or socat. Because exploitation can result in arbitrary code execution, absence of a single static IOC does not rule out compromise; combine log hunting with file integrity review and credential/persistence checks.

• POST /loader.php
• /loader.php
• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2E%2E%2F
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /proc/self/environ
• cmd=
• command=
• wget
• curl
• /bin/sh
• /bin/bash
• nc -e
• bash -c
• python -c
• perl -e
• php -r
• /usr/local/cwpsrv/htdocs/
• /usr/local/cwpsrv/htdocs/resources/
• /usr/local/cwpsrv/logs/
• authorized_keys
• /etc/cron.d/
• /var/spool/cron/

What your security team should do

• Prioritize immediate upgrade or isolation of any internet-facing Control Web Panel instances running v0.9.8.1122 or older.
• Treat exposed vulnerable systems as high-risk because public exploit code exists and EPSS is elevated.
• Restrict CWP administrative access to trusted networks, VPN, or bastion hosts; avoid direct internet exposure.
• Deploy temporary WAF or reverse-proxy rules blocking traversal patterns in POST requests to loader.php until patching is complete.
• Hunt historical logs for POST requests to loader.php containing traversal sequences, URL-encoded traversal, command-execution metacharacters, or suspicious response codes.
• Inspect CWP and hosted web directories for recently created PHP files, web shells, unexpected archives, modified administrative scripts, and anomalous ownership or permissions.
• Rotate credentials managed by the panel, including admin, database, FTP, mail, API, and SSH credentials, if exploitation cannot be ruled out.
• Review cron jobs, systemd services, authorized_keys files, local users, and outbound network connections for persistence or post-exploitation activity.
• If signs of compromise are found, perform incident response and consider rebuilding the server from a trusted image rather than only removing visible malicious files.