{"id":"CVE-2026-77881","kind":"vulnerability","aliases":["CVE-2026-77881"],"related":[],"title":"Control Web Panel: blind SQL injection in unauthenticated loopback route","description":"Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.","summary":"Control Web Panel (CWP) before 1.30 has an unauthenticated loopback API route that puts the 'user' parameter straight into a MySQL query. An attacker who can reach the route can use time-based blind SQL injection to read arbitrary database contents, which the route runs as MySQL root.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","linux-hosting","mysql","runtime","self-hosted"],"not_affected_if":["cwp-1.30-or-later"],"how_to_check":"- Check the installed CWP version (webpanel_version) and see whether it is below `1.30`.\n- Confirm whether the `/user_panel_dashboard/` or `/valid_token/` routes respond on the panel.","fix":"- Move Control Web Panel to `1.30` or later (webpanel_version).","status":"open","published_at":"2026-11-02T16:17:44+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:41+00:00","updated_at":"2026-11-02T16:26:41+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Control Web Panel to `1.30` or later (webpanel_version).","reach":"unknown","title":"Control Web Panel: blind SQL injection in unauthenticated loopback route","impact":"high","summary":"Control Web Panel (CWP) before 1.30 has an unauthenticated loopback API route that puts the 'user' parameter straight into a MySQL query. An attacker who can reach the route can use time-based blind SQL injection to read arbitrary database contents, which the route runs as MySQL root.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["control-web-panel","self-hosted","mysql","linux-hosting"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads arbitrary database contents as MySQL root","analyst_note":"Confirm whether the loopback route is reachable from outside the host and check the vulncheck.com advisory for the exact affected routes and exploitation details.","how_to_check":"- Check the installed CWP version (webpanel_version) and see whether it is below `1.30`.\n- Confirm whether the `/user_panel_dashboard/` or `/valid_token/` routes respond on the panel.","plain_action":"","needs_analyst":true,"not_affected_if":["cwp-1.30-or-later"],"who_is_affected":"Servers running Control Web Panel before webpanel_version 1.30. The flaw is in an unauthenticated route that reaches MySQL as root, so any host running an older CWP should be treated as exposed until upgraded. Hosts without CWP are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4211,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77881':13A,16A '/user_panel_dashboard':129C '/valid_token':131C '1.30':34B,85C 'api':39B,96C 'arbitrari':68B,142C 'attack':52B,119C 'base':62B,136C 'blind':4A,63B,88C,137C 'client':117C 'connect':99C 'contain':86C 'content':70B,144C 'control':1A,18B,29B,78C 'control-web-panel':17B 'craft':122C 'cve':11A,14A 'cwp':32B,81C 'databas':69B,143C 'direct':110C 'extract':141C 'host':23B,28B 'inject':6A,65B,90C,139C 'interpol':109C 'later':130C 'linux':22B 'linux-host':21B 'loopback':9A,38B,95C 'mysql':24B,49B,76B,101C 'oauth':116C 'origin':128C 'panel':3A,20B,31B,80C 'paramet':45B,107C 'perform':133C 'put':42B 'queri':50B,113C 'reach':55B 'read':67B 'request':123C 'root':77B,103C 'rout':10A,40B,57B,73B,97C,127C 'run':74B 'runtim':25B 'self':27B 'self-host':26B 'send':121C 'sql':5A,64B,89C,138C 'straight':46B 'tabl':118C 'time':61B,135C 'time-bas':60B,134C 'unauthent':8A,37B,94C,126C 'use':59B 'user':44B,106C 'version':84C 'vulner':91C 'web':2A,19B,30B,79C 'webpanel':83C","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel before webpanel_version 1.30. The flaw is in an unauthenticated route that reaches MySQL as root, so any host running an older CWP should be treated as exposed until upgraded. Hosts without CWP are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","linuxhosting","medium","mysql","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77881","severity":null,"published_at":"2026-11-02T16:17:44+00:00","modified_at":"2026-11-02T16:17:44+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null}],"documents":[{"id":52776,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}