by Kastro
Paper/Archive/CVE-2026-57517

CVE-2026-57517

Control Web Panel Control Web Panel — Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.6.616 × 2012.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.

Affected

ProductAffectedFixed inSource
Control Web Panel< 0.9.8.12250.9.8.1225CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitkarmainsecurity.com/KIS-2026-12patchcontrol-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2writeupvulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameterrefseclists.org/fulldisclosure/2026/Jul/9