Loading vulnerability…
CVE-2026-57517 is a blind SQL injection vulnerability affecting Control Web Panel versions before 0.9.8.1225. The flaw is caused by improper sanitization of user-supplied input in the userRes POST parameter at the user endpoint, where the value is incorporated into an SQL query without adequate neutralization. The issue is remotely exploitable without authentication. Successful exploitation allows an attacker to execute arbitrary SQL queries against the backend database with the privileges of the MySQL root account. Because the database account is reported to have file-write capability, the SQL injection can be escalated beyond database manipulation by using MySQL file output functionality such as INTO DUMPFILE to write attacker-controlled content to the filesystem. In the documented attack path, this enables placement of a PHP webshell in a web-accessible Roundcube logs directory, resulting in remote code execution as the cwpsvc account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Small standalone Go exploit repository centered on a single file, exploit_cwp.go, with README documentation and a .gitignore listing expected build/report artifacts. The code is not part of a major exploit framework. Its purpose is to target CVE-2026-57517 against Control Web Panel (CWP) by probing for CWP indicators, attempting username discovery from a built-in candidate list, exploiting a blind SQL injection condition, and then optionally deploying/using a webshell to achieve remote command execution. Notable implementation details visible from the code include: hardcoded default ports 2083 (CWP) and 2031 (webshell access), randomized User-Agent selection, disabled TLS certificate verification, helper routines for base64 and hex encoding, regex-based parsing of command output markers, target normalization, deduplication, concurrency support for mass targeting, and JSON/text reporting. The main program supports single-target mode, file-based bulk mode, and an interactive shell mode. CLI options shown in the README and code include target/file input, username override, thread count, timeout, cleanup control, RCE mode, existing shell URL reuse, verbosity, and output report paths. Overall capability: this is an operational exploit tool rather than a simple detector. It appears able to move from identification to exploitation and post-exploitation command execution, with optional cleanup and reporting. The repository is minimal, with one primary entry point and no auxiliary libraries or modules included in the provided content.
This repository is a standalone Python exploit for CVE-2026-57517 affecting Control Web Panel <= 0.9.8.1224. The repository is small and focused: a single main exploit script (cve_2026_57517.py), a README with exploitation workflow and examples, a requirements file, and a banner asset. The exploit is not part of a larger framework. The main capability is pre-authentication exploitation of a blind SQL injection in the userRes POST parameter on the CWP user/admin panel over HTTPS port 2083. According to the included documentation and visible code structure, the script supports: target validation, username discovery using common usernames and login-response differences, single-target exploitation, multi-target threaded scanning, live result logging, JSON reporting, optional cleanup, and an interactive shell mode. The exploitation chain is: identify a reachable CWP instance, determine or accept a valid username, send a crafted SQL payload using a 13-column UNION SELECT, and leverage MySQL FILE privileges with INTO DUMPFILE to write a PHP webshell into /usr/local/cwpsrv/var/services/roundcube/logs/. The shell is then accessed over HTTPS port 2031 under /roundcube/logs/<random>.php. Commands are delivered through a custom HTTP header named C containing base64-encoded PHP/command content; the shell decodes and executes it, yielding RCE as the cwpsvc account. The README explicitly shows the shell payload and command execution pattern. Code structure visible from the script includes helper routines for hex/base64 encoding and randomization, a TargetResult dataclass for per-host state, a thread-safe LiveWriter for output, and main logic for single-target and mass-scan modes. Constants define TIMEOUT=15, MAX_WORKERS=20, CWP_PORT=2083, WEBSHELL_PORT=2031, common usernames, and login-related discovery endpoints (/ and /login/index.php). The script uses requests/urllib3, disables SSL warnings, and appears designed for operational use rather than mere detection. Overall, this is an operational exploit tool that automates the full chain from blind SQL injection to dropped webshell and confirmed remote command execution, with mass exploitation and post-exploitation interaction features.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a vulnerability identifier in a GitHub conversation about adding templates; no technical details are provided in the content.
A critical blind SQL injection vulnerability in Control Web Panel before version 0.9.8.1225 that can allow unauthenticated attackers to execute arbitrary SQL queries and potentially achieve remote code execution by writing a PHP webshell.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.