gagaltotal/CVE-2026-57517-CWP

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based tool that exploits CVE-2026-57517, a blind SQL injection in Control Web Panel, to achieve remote code execution. It detects CWP instances, enumerates valid usernames, injects a SQL payload via the userRes parameter to write a PHP webshell using INTO DUMPFILE, and then executes arbitrary commands through the deployed shell.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code and README implement a proof-of-concept exploit for CVE-2026-57517, a blind SQL injection vulnerability in Control Web Panel. The code performs CWP detection, username enumeration, SQL injection to write a PHP webshell via INTO DUMPFILE, and optional command execution through that webshell. All behavior is consistent with the stated purpose of demonstrating and testing the vulnerability. No concealed, deceptive, or operator-directed harmful behavior unrelated to the exploit was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesGo
Target softwareControl Web Panel (CWP)
Attack typesSQL InjectionRemote Code ExecutionWeb Shell Deployment
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits a vulnerability by sending a malicious SQL payload (UNION SELECT ... INTO DUMPFILE) to write a webshell, then uses that shell to execute arbitrary commands. This goes beyond detection or scanning; it performs the full exploitation chain to achieve remote code execution.

exploit_cwp.go:498exploit_cwp.go:557-582

Requirements

  • A target host running a vulnerable version of Control Web Panel (before 0.9.8.1225) accessible on port 2083.exploit_cwp.go:26exploit_cwp.go:479-481
  • The target must have a writable path for the INTO DUMPFILE operation, such as the roundcube logs directory.exploit_cwp.go:489-495

Observed behavior

  • Detects Control Web Panel by checking HTTP responses for CWP-specific strings on port 2083.exploit_cwp.go:338-359
  • Enumerates valid CWP usernames by probing known usernames and analyzing login responses.exploit_cwp.go:374-461
  • Exploits a blind SQL injection by sending a crafted userRes POST parameter containing a UNION SELECT ... INTO DUMPFILE payload to write a PHP webshell to the server.exploit_cwp.go:479-536
  • Verifies the deployed webshell by sending a command via a custom HTTP header and checking for the expected output.exploit_cwp.go:538-555
  • Executes arbitrary operating system commands on the target through the webshell and returns the output.exploit_cwp.go:557-582
  • Provides an interactive shell mode for continuous command execution.exploit_cwp.go:936-982
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Deployment
<?php eval(base64_decode($_SERVER["HTTP_C"])); ?>The exploit writes a minimal PHP webshell to the target server's roundcube logs directory using SQL injection. This is the core of the demonstrated RCE chain and is expected behavior for a CVE-2026-57517 PoC.exploit_cwp.go:486
Command Execution
ExecCommand function sends base64-encoded commands via HTTP header 'C' to the deployed webshellThe tool includes functionality to execute arbitrary commands on the compromised host through the webshell. This is part of the advertised RCE capability and is not hidden or unrelated to the exploit.exploit_cwp.go:557-582
Cleanup Function
CleanupShell sends @unlink(__FILE__); to remove the webshellThe tool provides an optional cleanup mechanism to delete the deployed webshell, which is a standard feature for authorized testing tools and does not indicate backdoor behavior.exploit_cwp.go:584-599
Review boundaries

What the analysis did not establish

  • The evidence includes only the Go source code and README; the binary is not provided, and the code was not executed.
  • The repository contains a non-text media file (screenshot) that was not analyzed.
  • The evidence does not include the go.mod file content, which may contain dependency information.
  • The go.mod file and any binary or non-text files in the repository were not included in the text evidence. Their contents could not be reviewed.
  • The analysis is limited to the static source code; runtime behavior or compiled binary behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1