CVE-2026-77879 in Control Web Panel
Summary
by MITRE • 11/02/2026
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Control Web Panel (CWP) software, specifically versions prior to webpanel_version 1.16, contains a critical security flaw within its loopback application programming interface. This vulnerability is located in the access_token() function which serves as an authentication gate for API requests. The core technical issue stems from improper neutralization of special elements used in SQL commands, commonly known as SQL injection. In this specific implementation, the system connects to the MySQL database using the root user account and directly interpolates attacker-controlled values into its query strings without adequate sanitization or parameterized queries. This design flaw allows malicious actors to inject arbitrary SQL code through the authorization_code and client_id parameters during the authentication process.
The operational impact of this vulnerability is severe due to the privilege level at which the database connection operates. Because the application connects as root, successful exploitation grants an attacker full read access to all data stored within the CWP MySQL database. This includes sensitive information such as user credentials, server configurations, and potentially other critical system metadata. Furthermore, by manipulating the authentication logic through SQL injection, attackers can forge valid authentication results. This effectively bypasses the API's intended security controls, allowing unauthorized access to administrative functions and services that should be restricted to legitimate users with proper credentials.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command. The attack vector leverages input validation failures where user-supplied data is executed as part of a database command without sufficient filtering or escaping mechanisms. In terms of tactical behavior within the MITRE ATT&CK framework, this exploitation technique falls under T1059 Command and Scripting Interpreter with specific sub-techniques related to SQL commands for information retrieval such as T1059.007. The ability to bypass authentication checks also relates to T1078 Valid Accounts where attackers use compromised or forged credentials to maintain persistent access.
Mitigation strategies should prioritize immediate patching of the Control Web Panel software to version 1.16 or later, which addresses these input validation deficiencies. Until an update is applied, administrators can implement network-level controls by restricting loopback API access to trusted local processes only and ensuring that no external interfaces expose this endpoint. Additionally, database security hardening measures such as applying the principle of least privilege are recommended; while fixing the code is primary, reducing the permissions of the application's database user account would limit the blast radius if similar vulnerabilities exist elsewhere in the system. Regular audits of API endpoints for proper parameterization and input sanitization practices will further reduce exposure to SQL injection attacks across the infrastructure.