CVE-2026-57517: Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Synopsis

Blind SQL injection in Control Web Panel before version 0.9.8.1225 allows an unauthenticated remote attacker to submit malicious input through the userRes POST parameter at the user endpoint, bypassing all authentication entirely. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation gives the attacker full read and write access to the underlying MySQL database (running as root), the ability to drop a PHP webshell into the web-accessible roundcube logs directory, and remote code execution as the cwpsvc service account. A patched-image rebuild at version 0.9.8.1225 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP POST requests to the target host to exploit this vulnerability.

• AuthenticationNot required

  No credentials of any kind are needed; the injection point in the userRes parameter is reachable by any unauthenticated request.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions or special environmental factors required.

Blast Radius

• Reads any data stored in the MySQL database, including user credentials, session tokens, and hosted-domain configuration records.
• Writes arbitrary content to the filesystem by abusing MySQL root-level INTO DUMPFILE privileges, enabling placement of a PHP webshell in the web-accessible roundcube logs directory.
• Executes arbitrary operating system commands as the cwpsvc service account once the webshell is deployed, giving the attacker persistent interactive access to the host.
• Modifies or deletes database rows, allowing tampering with panel configuration, hosted accounts, and access control records.