Control Web Panel before version 0.9.8.1225 contains a blind SQL injection flaw (CWE-89) that allows an attacker to inject arbitrary SQL statements through the unsanitized POST parameter named userRes at the "/user" endpoint. The injection can elevate privileges to the MySQL root account, enabling the attacker to write arbitrary files with INTO DUMPFILE. A malicious PHP web shell can then be placed in the publicly accessible roundcube logs directory, giving the attacker remote code execution capabilities under the cwpsvc service account, effectively compromising confidentiality, integrity, and availability of the system.

All Control Web Panel deployments running a version older than 0.9.8.1225 are affected. The vulnerability is present in any installation that serves the default /user endpoint over a web interface that is reachable from untrusted networks.

The CVSS base score of 9.3 indicates high severity, but the EPSS score of <1% suggests a low, yet nonzero, likelihood of exploitation. The vulnerability is not yet listed in CISA KEV, which does not lower the risk. The likely attack path involves an unauthenticated attacker sending a crafted POST request to the /user endpoint, leveraging the blind injection to elevate privileges to the MySQL root account, then using INTO DUMPFILE to deploy a PHP web shell into a publicly accessible web directory. Because the attack requires only network connectivity to the web interface, it can be performed from anywhere on the Internet with minimal effort.