{"id":2673,"date":"2026-07-08T04:49:34","date_gmt":"2026-07-08T11:49:34","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2673"},"modified":"2026-07-08T04:49:36","modified_gmt":"2026-07-08T11:49:36","slug":"emerging-threat-cve-2026-57517-control-web-panel-remote-code-execution-via-sql-injection","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-57517-control-web-panel-remote-code-execution-via-sql-injection\/","title":{"rendered":"Emerging Threat: (CVE-2026-57517) Control Web Panel Remote Code Execution via SQL Injection"},"content":{"rendered":"\n

What is CVE-2026-57517?<\/h2>\n\n\n\n

CVE-2026-57517 is a blind SQL injection vulnerability in Control Web Panel (CWP), caused by insufficient sanitization of the userRes<\/code> POST parameter submitted to the panel’s user endpoint before the value is used to build a SQL query. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).<\/p>\n\n\n\n

Exploitation is unauthenticated in the sense that no login session is required, but it does depend on the attacker knowing or correctly guessing the username of a valid, non-root account on the target CWP instance. Once that condition is met, the attacker can execute arbitrary SQL queries with the privileges of the MySQL root account.<\/p>\n\n\n\n

The practical impact extends well beyond data exposure. Because the MySQL root account on a CWP install carries the global FILE<\/code> privilege, an attacker can use INTO DUMPFILE<\/code> to write arbitrary files to writable locations on the server. Researchers demonstrated that this can be used to drop a PHP payload into a web-accessible logs directory, resulting in full remote code execution with the privileges of the cwpsvc<\/code> account.<\/p>\n\n\n\n

What assets are affected by CVE-2026-57517?<\/h2>\n\n\n\n

The vulnerability affects Control Web Panel versions 0.9.8.1224 and earlier. CWP, formerly known as CentOS Web Panel, is a free server management interface used to administer VPS and dedicated servers running CentOS and its downstream derivatives such as Rocky Linux and AlmaLinux.<\/p>\n\n\n\n

In practice, an affected asset is a server exposing the CWP administrative interface, typically reachable at https:\/\/[host]:2083\/[username]\/<\/code>. Because CWP is built around a shared-hosting model, in which a single server hosts accounts for multiple end customers, the admin interface is frequently left internet-facing by design rather than by oversight.<\/p>\n\n\n\n

CWP has a recent history of critical, unauthenticated vulnerabilities, including an OS command injection flaw disclosed in 2025. Products in this category tend to stay exposed longer than average: operators running low-cost or free hosting panels often deprioritize patching relative to commercial infrastructure, and the multi-tenant nature of the platform can make maintenance windows harder to schedule.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Exposure in this set is led by Consumer Staples at 32.1% of observed assets, with Consumer Discretionary contributing 28.6%.<\/p>\n\n\n\n

The concentration in Consumer Staples and Consumer Discretionary tracks with how these sectors typically run their online infrastructure. Retail, hospitality, and packaged goods organizations frequently operate a mix of regional storefronts, franchise sites, and partner-managed subdomains, often provisioned through low-cost hosting arrangements rather than centrally managed infrastructure. That pattern creates more opportunities for a hosting-panel product like CWP to end up running on an internet-facing server without central IT’s direct oversight.<\/p>\n\n\n\n

The broader cross-sector spread, including a meaningful Industrials share, points to a recurring driver behind exposure to this class of vulnerability: visibility gaps around infrastructure provisioned outside the primary IT organization. Marketing microsites, regional subdomains, and vendor- or franchise-managed servers are exactly the kind of assets that tend to run unmonitored software and go unpatched long after a fix is available.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Yes. The CWP vendor released version 0.9.8.1225, which fixes the userRes<\/code> sanitization flaw. Organizations running an earlier version should treat upgrading to 0.9.8.1225 or later as the primary remediation step.<\/p>\n\n\n\n

A public proof of concept for CVE-2026-57517 is already available, which increases the likelihood of opportunistic scanning and exploitation attempts against unpatched instances.<\/p>\n\n\n\n

Defenders should confirm their running CWP version directly against the vendor’s release notes rather than assuming a scheduled update has already applied the fix, particularly on servers managed by a hosting provider or reseller rather than in-house.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Until every instance is confirmed patched, defenders should:<\/p>\n\n\n\n