CVE-2026-57517
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile — higher than 44% of all known CVEs
Summary
Control Web Panel before version 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
Risk Assessment
The risk for the organization includes full server compromise by an unauthenticated attacker, potentially leading to data theft, malware installation, or further attacks on internal infrastructure.
Recommendation
It is recommended to immediately update Control Web Panel to version 0.9.8.1225 or later and restrict access to the management panel only from trusted IP addresses.
Original NVD description (English source)
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.