cbcvebase.
CVE-2021-31316
published 2021-05-18

CVE-2021-31316: The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
13.03%
95.9th percentile
The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

Detection & IOCsextracted from sources · hover to see the quote

url/login/index.php?acc=newpass↗
commandpass1=c3VwZXJwYXNzd29yZA%3D%3D&idsession=a'%20UNION%20SELECT'a'%2c'b'%2c'c'%2c'YWJjIiBVTklPTiBTRUxFQ1QgJ2EnLCdiJywnYycsJ2QnLCcrMSBkYXknLCdmJy0tIHAiO3NsZWVwIDc7I2B8fGF8fGJ8fGN8fGQ%3d'%2c'e'%2c'f'-- p↗
cookiecwpsrv↗
  • →Detect exploitation attempts by monitoring HTTP POST requests to /login/index.php?acc=newpass containing UNION SELECT payloads in the 'idsession' parameter, combined with time-based sleep delays (>=7 seconds response duration). ↗
  • →CentOS Web Panel servers can be fingerprinted via the 'cwpsrv' string present in HTTP response headers; use this to scope detection to relevant assets. ↗
  • →Shodan/FOFA query to identify exposed CentOS Web Panel login pages as potential targets: title:"Login | Control WebPanel" ↗
  • →The SQL injection payload uses a time-based blind technique (sleep 7) encoded in the idsession POST parameter; alert on anomalous response times (>=7s) from /login/index.php alongside UNION SELECT patterns. ↗
  • →The attack is unauthenticated and targets the unprivileged user portal endpoint; no session or credentials are required prior to exploitation. ↗
  • ·The SQL injection payload is time-based blind (sleep-based); detection relying solely on response content may miss exploitation. Response duration threshold of >=7 seconds is the primary confirmation signal. ↗
  • ·The exploit flow requires a two-step HTTP interaction: first a GET to '/' to confirm the cwpsrv header fingerprint, then the POST with the malicious idsession payload. Single-request detections may miss the full attack chain. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.