Threats tagged 'ghsa-mgcx-hxxw-4q57'

Control Web Panel (CWP) versions before 1.30.6 have an authorization bypass vulnerability in the validate() function of api/v1/index.php. This flaw allows attackers possessing a password-recovery token and a predictable legacy signature to gain remote API authorization without a valid API key. Exploitation via the POST /cronjobsusers/ endpoint enables attackers to add arbitrary cron commands, resulting in command execution under the affected hosting account. Additionally, attackers can access global account lists and details, exposing sensitive user information including usernames, contact emails, and password hashes.