CVE-2020-15620: 
Control Web Panel vulnerability analysis and mitigation

CentOS Web Panel (cwp-e17.0.9.8.923) contains a vulnerability that allows remote attackers to disclose sensitive information. The vulnerability was discovered on January 31, 2020, and was publicly disclosed on June 25, 2020, after the 120-day disclosure deadline (ZDI Advisory).

The vulnerability exists within ajax_list_accounts.php where the process fails to properly validate a user-supplied string before using it to construct SQL queries. This SQL injection vulnerability has been assigned a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity with network attack vector, low attack complexity, and no required privileges or user interaction (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive information in the context of root. The vulnerability allows for information disclosure without requiring authentication (ZDI Advisory).

The vulnerability is remotely exploitable and does not require authentication to exploit. The attack can be performed over the network with low complexity, making it relatively straightforward to exploit (ZDI Advisory).

The primary mitigation strategy is to restrict interaction with the service to trusted machines. This can be implemented through firewall rules and whitelisting to ensure that only legitimate clients and servers with procedural relationships to the service are permitted to communicate with it (ZDI Advisory).

The vendor was initially responsive to the vulnerability report, indicating they had a fix for the issues on May 8, 2020. However, after multiple follow-ups and status update requests, the vulnerability was ultimately published as a zero-day advisory due to lack of patch release (ZDI Advisory).