shinthink/CVE-2026-57517

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based mass exploitation tool for CVE-2026-57517 that performs blind SQL injection on Control Web Panel to deploy a PHP webshell and achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2026-57517. The script performs the documented SQL injection and deploys a PHP webshell to achieve RCE, which is the normal exploit behavior for this CVE. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit was observed. The code is straightforward and its actions align with the described vulnerability exploitation chain.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareControl Web Panel
Attack typesSQL InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (cve_2026_57517.py) that actively exploits CVE-2026-57517 by performing SQL injection to write a PHP webshell to the target filesystem and then executing arbitrary commands. The README describes it as a 'Mass Scanner + Validator + Interactive Shell' and the code includes functions for deploying a webshell (exploit_sqli), verifying it (_verify_shell), and executing commands (exec_command). This constitutes an exploit, not merely a scanner or writeup.

cve_2026_57517.py:331-390cve_2026_57517.py:407-422README.md:4-5

Requirements

  • Target must be running a vulnerable version of Control Web Panel (≤ 0.9.8.1224) on port 2083.README.md:25
  • A valid CWP username must be known or enumerable.cve_2026_57517.py:235-325

Observed behavior

  • Detects if a host is running Control Web Panel by checking for CWP indicators in HTTP responses on port 2083.cve_2026_57517.py:192-229
  • Enumerates valid CWP usernames via HTTP GET requests to user panel paths and login page response differentiation.cve_2026_57517.py:235-325
  • Exploits a blind SQL injection in the userRes POST parameter by sending a UNION SELECT payload with a hex-encoded PHP webshell, using INTO DUMPFILE to write the shell to the Roundcube logs directory.cve_2026_57517.py:331-390
  • Verifies the deployed webshell by sending a base64-encoded PHP command via the HTTP 'C' header and checking for a unique token in the response.cve_2026_57517.py:392-405
  • Executes arbitrary operating system commands on the target via the webshell and returns the output.cve_2026_57517.py:407-422
  • Optionally cleans up the deployed webshell by sending a self-deleting PHP command.cve_2026_57517.py:424-432
  • Supports mass scanning of multiple targets with configurable concurrency and real-time result logging.cve_2026_57517.py:507-561
  • Provides an interactive shell mode for direct command execution on a compromised target.cve_2026_57517.py:675-711
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
SQL injection via userRes parameter to write a PHP webshell using INTO DUMPFILEThis is the documented exploit chain for CVE-2026-57517 and does not constitute a backdoor.cve_2026_57517.py:331-390
Exploit Behavior
Deployed webshell executes commands via HTTP header C: with base64-encoded PHPThis is the standard command execution method for the deployed webshell and matches the README description.cve_2026_57517.py:407-422
Cleanup Mechanism
Optional cleanup of deployed webshell via --no-cleanup flagThe script can leave shells on target if --no-cleanup is used, but this is a user-controlled option, not a hidden backdoor.cve_2026_57517.py:424-432
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. The packet metadata shows 3 text files with content and 2 text files without content, plus 1 non-text file. The missing files could contain additional context, but the provided files are sufficient for classification.
  • Three files from the repository were omitted from the evidence: one non-text media file (banner.svg) and two unclassified files. Their content was not reviewed, but the inventory indicates they are not executable scripts.
  • The review is limited to static analysis of the provided source code; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1