CVE-2026-57517: Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Control Web Panelto a version that resolves this vulnerability.Fixed in 0.9.8.1225 - Compensating control
Restrict access so unauthenticated remote attackers cannot reach the Control Web Panel user endpoint that accepts the unsanitized input via the userRes POST parameter (e.g., via network/WAF/ACL)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57517?
CVE-2026-57517 has a severity score of 9.3, indicating it is critical.
What type of vulnerability is associated with CVE-2026-57517?
CVE-2026-57517 is a blind SQL injection vulnerability that affects Control Web Panel.
How can I fix CVE-2026-57517?
To fix CVE-2026-57517, update Control Web Panel to version 0.9.8.1225 or later.
Who is affected by CVE-2026-57517?
Users of Control Web Panel versions prior to 0.9.8.1225 are at risk from CVE-2026-57517.
What impact can CVE-2026-57517 have on a system?
CVE-2026-57517 allows unauthenticated attackers to execute arbitrary SQL queries, potentially compromising database security.