External risk intelligence

Control Web Panel Blind SQL Injection Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57517

Control Web Panel is a server management interface designed to be exposed to the internet for administrative access. The vulnerability is exploitable via a public-facing web endpoint without authentication, making it directly reachable and highly accessible to remote attackers in typical deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Control Web Panel is affected by a critical vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries. If exploited, this could lead to unauthorized file writes and the deployment of a web shell, potentially resulting in remote code execution.

Unauthenticated attackers can run malicious commands.
It allows remote code execution on affected systems.
Confirm relevance and exposure to impacted systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a blind SQL injection vulnerability in Control Web Panel's user endpoint. By sending crafted input to the userRes POST parameter, attackers can execute arbitrary SQL queries. This could allow them to gain MySQL root privileges and use features like INTO DUMPFILE to write arbitrary files. The ultimate goal is to place a PHP webshell in the roundcube logs directory, leading to remote code execution as the cwpsvc account.

No authentication or special access is required.
Submitted data in the userRes parameter triggers the issue.
Achieve remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

A blind SQL injection vulnerability in the user endpoint could allow unauthenticated remote attackers to execute arbitrary SQL queries. When supported by the advisory, this could lead to the deployment of a webshell and remote code execution.

System files could be affected.
Attackers may write arbitrary files.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Control Web Panel (CWP) vulnerability impacts systems where the panel is deployed and exposed, likely requiring action from infrastructure or platform teams responsible for server management. The initial step involves identifying all CWP instances, assessing their external reachability and business criticality, and locating the accountable system owner to prioritize remediation efforts based on risk.

Identify CWP instances and ownership.
Verify external reachability and business impact.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Control Web Panel?

Control Web Panel is a server management interface used by administrators to oversee and configure web hosting environments. It provides a dashboard to manage services like databases, email accounts, and file systems, typically serving as the central control hub for a server.

What does CWE-89 mean for CVE-2026-57517?

CWE-89 refers to Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection. In this CVE, it means the application does not safely filter user-supplied data before including it in database queries. This failure allows an attacker to manipulate the underlying database commands, potentially leading to unauthorized data access or malicious operations like writing arbitrary files to the server.

How is this vulnerability triggered?

The flaw is triggered by sending specially crafted, unsanitized input to the userRes POST parameter at the CWP user endpoint. Because the vulnerability exists in the handling of this specific input, simply browsing the web panel or using legitimate features without triggering this parameter does not inherently cause the issue. It requires an attacker to deliberately inject malicious SQL syntax through that specific field.

Is my server at high risk?

Halo Surface Signal classifies this vulnerability as very likely to be reachable because Control Web Panel is designed to be accessible via the internet for remote administration. If your CWP login or user endpoints are exposed to the public internet, they are directly reachable by remote attackers, significantly increasing the risk of exploitation compared to services restricted to internal networks.

How should I respond to this threat?

Begin by auditing your infrastructure to locate all instances of Control Web Panel and identifying who is responsible for managing each server. Once you have a clear inventory, prioritize assessing which instances are exposed to the internet. Coordinate with your system owners to apply official updates provided by the vendor, ensuring you move beyond vulnerable versions to protect the management interface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.