Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries b…

Control Web Panel versions before 0.9.8.1225 contain a blind SQL injection vulnerability in the userRes POST parameter at the user endpoint. The flaw allows unauthenticated remote attackers to execute arbitrary SQL queries without any authentication. Attackers can leverage MySQL root privileges obtained through the injection to write arbitrary files using the INTO DUMPFILE directive. This capability enables the deployment of a PHP webshell to the web-accessible roundcube logs directory. Successful exploitation results in remote code execution running as the cwpsvc account. The vulnerability chain effectively provides full server compromise from an unauthenticated network position. A patch is available in version 0.9.8.1225 and later.