CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Control Web Panel pre-auth blind SQLi to web-shell RCE via INTO DUMPFILE (CVSS 9.8)

cve · CVE-2026-57517 single-source-national-cert

Coverage
1
first 2026-07-03 → last 2026-07-03
Latest activity
2026-07-03
CVE-2026-57517, Control Web Panel: pre-auth SQLi to RCE via INTO DUMPFILE (CVSS 9.8)
Peak priority
high
1 high
Targets
technology
sectors: technology, education
Sources cited
2
2 hosts

Action items (3)

Do-now tasks recorded on the entries about CVE-2026-57517, newest first. Check the date before acting on an older one.

  • Update internet-facing Control Web Panel instances to 0.9.8.1225 or later now. The fix predates the public CVE by ~2 months, so any host not updated since May 2026 is exposed.
    2026-07-03CVE-2026-57517
  • Treat patching as insufficient for compromise: check web-accessible directories under the CWP docroot (CCB names the Roundcube logs directory) for planted .php web shells before considering a previously-exposed host clean.
    2026-07-03CVE-2026-57517
  • Hunt CWP/web-server access logs for SQL syntax (UNION, SLEEP(), INTO DUMPFILE/OUTFILE) in the userRes POST parameter, and alert on the cwpsvc service account spawning shell interpreters.
    2026-07-03CVE-2026-57517

Defender insights

What each entry about CVE-2026-57517 tells a defender to do, newest first.

Story timeline

  1. 2026-07-03CVE-2026-57517, Control Web Panel: pre-auth blind SQL injection to web-shell RCE (CVSS 9.8)
    trending-vulnerabilitiesCVE-2026-57517, Control Web Panel: pre-auth SQLi to RCE via INTO DUMPFILE (CVSS 9.8)

Hunting pivots

Tags
patch-availablepre-authrcesqlivulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceServer Software Component: Web Shell

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-03/cve-2026-57517-control-web-panel-pre-auth-sqli-to-rce · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-07-03/cve-2026-57517-control-web-panel-pre-auth-sqli-to-rce · ATT&CK page ↗

Entries about Control Web Panel pre-auth blind SQLi to web-shell RCE via INTO DUMPFILE (CVSS 9.8) (1)

2026-07-03 · view entry permalink →

HIGHCVE-2026-57517

CVE-2026-57517, Control Web Panel: pre-auth blind SQL injection to web-shell RCE (CVSS 9.8)

CCB Belgium published a fresh advisory for CVE-2026-57517, a pre-authentication blind SQL injection in Control Web Panel, the widely deployed Linux hosting/server-management platform formerly known as CentOS Web Panel (CCB, 2026-07-03). The vulnerable input is the userRes POST parameter in the CWP user module; insufficient sanitisation lets an unauthenticated attacker inject SQL that runs with the backend database's privileges (CWE-89, CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CVSS 4.0 9.3). The disclosed chain uses INTO DUMPFILE to blind-write an attacker-controlled PHP web shell into a web-accessible directory without needing query output or credentials; the shell then executes commands as the cwpsvc service account, yielding full server compromise. CCB states there is no evidence of in-the-wild exploitation yet but flags the pre-auth, no-interaction nature and CWP's large internet-facing footprint as a high-priority risk. The vendor changelog shows 0.9.8.1225 shipped 2026-05-06 (roughly two months before the public CVE disclosure on 2026-07-01) so instances left unpatched since the silent fix remain exposed today (Control Web Panel changelog, 2026-05-06). Mapped to T1190 Exploit Public-Facing Application for the SQLi vector and T1505.003 Server Software Component: Web Shell for the DUMPFILE-written shell.

This blind SQL injection vulnerability in the userRes parameter allows unauthenticated remote attackers to write arbitrary files to the underlying filesystem and achieve remote code execution.

There is no evidence of exploitation in the wild, however, the combination of critical severity, lack of authentication requirements, and CWP's large internet-facing footprint makes this a high-priority risk.

Centre for Cybersecurity Belgium (CCB)
vulnerability03 Jul 18:25Zsingle-source · national CERTOpen finding →
Sources: Centre for Cybersecurity Belgium (CCB) · Control Web Panel vendor changelog

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • ccb.belgium.be1 (50%)
  • control-webpanel.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)