Public PoC Code Exposes CVSS 9.8 Control Web Panel SQL Injection CVE-2026-57517

Security researchers publicly disclosed a critical vulnerability in Control Web Panel alongside proof-of-concept exploit code. This flaw, identified as CVE-2026-57517, carries a maximum CVSS score of 9.8.

TL;DR

A severe vulnerability exists in Control Web Panel. This Control Web Panel SQLi flaw allows remote code execution. A public proof-of-concept exploit is now available online. Administrators must patch their servers immediately to prevent attacks.

Why It Matters

Control Web Panel manages thousands of web hosting environments globally. CVE-2026-57517 threatens these servers with complete compromise. Attackers do not need prior authentication to exploit this bug. Furthermore, the public release of the proof-of-concept code increases the immediate danger. Threat actors often weaponize public exploits quickly to target unpatched systems. Therefore, server administrators face an urgent risk of data breaches and server hijacking. Protecting these hosting environments requires swift administrative action.

How the Attack Works

The vulnerability originates at the user endpoint. Specifically, the system fails to sanitize input within the “userRes” POST parameter. This failure permits unauthenticated attackers to execute arbitrary SQL queries. According to the advisory, “successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries with the privileges of the MySQL root user.” This account possesses global file modification capabilities. Attackers write arbitrary files to the filesystem using the INTO DUMPFILE command. They typically deploy a PHP webshell into the web-accessible Roundcube logs directory. Consequently, they achieve remote code execution as the cwpsvc account. They can then control the server remotely.

Affected Versions

This blind SQL injection flaw impacts older installations of the software. Control Web Panel versions prior to 0.9.8.1225 contain the vulnerability. Currently, researchers have published a public proof-of-concept exploit code. You can view the exploit details in the Karma In Security report. However, experts have not confirmed active exploitation in the wild yet.

Patch and Mitigation Steps

Administrators must update their systems right away. Upgrade to Control Web Panel version 0.9.8.1225 or newer. Additionally, audit your server logs for unexpected files in the Roundcube directory. Restrict access to the administrative panel using firewall rules where possible. Network segmentation can also help isolate critical database services.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.