CVE-2026-57517

CRITICAL

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-57517. PoCs published by gagaltotal, shinthink.

AI-analyzed exploit summary This Go-based exploit targets CVE-2026-57517, a blind SQL injection vulnerability in Control Web Panel (CWP) that leads to remote code execution (RCE) via webshell deployment. The PoC includes username enumeration, SQLi exploitation, webshell upload, and command execution with output retrieval.

Description

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.

Exploits (2)

github WORKING POC
by gagaltotal · gopoc
https://github.com/gagaltotal/CVE-2026-57517-CWP

This Go-based exploit targets CVE-2026-57517, a blind SQL injection vulnerability in Control Web Panel (CWP) that leads to remote code execution (RCE) via webshell deployment. The PoC includes username enumeration, SQLi exploitation, webshell upload, and command execution with output retrieval.

Classification
Working Poc 98%
Attack Type
Sqli, Rce
Complexity
Moderate
Reliability
Reliable
Target: Control Web Panel (CWP)
No auth needed
Prerequisites: Network access to CWP on port 2083 (HTTPS) · Valid CWP username (enumerated automatically or provided) · Vulnerable CWP version (unspecified in code)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →
github WORKING POC
by shinthink · pythonpoc
https://github.com/shinthink/CVE-2026-57517

This repository contains a functional exploit for CVE-2026-57517, a pre-authentication blind SQL injection in Control Web Panel (CWP) ≤ 0.9.8.1224. The exploit leverages MySQL's INTO DUMPFILE to write a PHP webshell, achieving remote code execution as the 'cwpsvc' service account.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Control Web Panel (CWP) ≤ 0.9.8.1224
No auth needed
Prerequisites: Target must be running CWP ≤ 0.9.8.1224 · MySQL must have FILE privilege (default in CWP) · Web-accessible directory writable by MySQL (e.g., Roundcube logs)
mistral-large-3 · analyzed Jul 04, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit technical-description exploit
Karma(In)Security Disclosure
https://karmainsecurity.com/KIS-2026-12

Scores

CVSS v3 9.8
EPSS 0.0115
EPSS Percentile 63.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
Control Web Panel/Control Web Panel < 0.9.8.1225
Published Jul 01, 2026
Tracked Since Jul 01, 2026