CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload) — Threadlinqs Intelligence
As of 2026-07-20, CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-1568 · Severity: HIGH · CVSS: 9.3 · Status: ACTIVE · Category: VULNERABILITY
CERT Polska disclosed three vulnerabilities in JCD's Windu CMS 4.1: CVE-2026-57309, an unauthenticated blind SQL injection via the HTTP URL path/header (CWE-89, CVSS 4.0 9.3 CRITICAL); CVE-2026-57310,
On 20 July 2026, CERT Polska (CERT.PL) published a coordinated vulnerability disclosure covering three flaws in Windu CMS version 4.1, a Twitter-Bootstrap-based content management system developed by the Polish interactive agency JCD (jcd.pl), reportedly deployed on more than 10,000 websites in Poland and abroad. The vulnerabilities were reported directly to CERT Polska by researchers Jakub Lipinski, Marek Tolczyk, and Kamil Krolikowski, and CERT Polska's attempts to contact the vendor for coordinated remediation were unsuccessful, meaning no fixed version or patch has been published at time of writing.
CVE-2026-57309 is the most severe of the three: a blind SQL injection (CWE-89) reachable by a remote, unauthenticated attacker who injects SQL syntax into the URL path as reflected through an HTTP header. NVD scored it CVSS 4.0 9.3 (CRITICAL, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N), reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality/integrity impact on the vulnerable component with low availability impact. Blind SQLi of this kind is typically exploited via boolean-based or time-based inference (e.g., SLEEP()/BENCHMARK() timing oracles, or conditional response-length/content differences) to enumerate database contents -- most critically the user credential table -- without needing a UNION-based or error-based response leak.
CVE-2026-57310 compounds the SQLi impact: Windu CMS stores user passwords hashed with MD5 and/or SHA1 combined with a static (non-per-user, non-rotating) salt (CWE-916, Insufficient Computational Effort). A static salt defeats the purpose of salting -- it does not prevent rainbow-table or bulk dictionary/brute-force attacks across the full user base once hashes are exfiltrated, since every hash uses the identical salt value baked into the application. NVD scored this CVSS 4.0 6.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). Combined with CVE-2026-57309, an unauthenticated attacker can blind-SQLi the users table, dump the MD5/SHA1+static-salt hashes, and crack them at scale offline (GPU-accelerated hashcat/John the Ripper against MD5/SHA1 is trivial and fast) to recover plaintext admin/user credentials.
CVE-2026-57311 provides the privilege-escalation and code-execution capstone: Windu CMS's authenticated file-upload functionality does not validate uploaded file types (CWE-434, Unrestricted Upload of File with Dangerous Type), permitting an authenticated user -- including credentials recovered via the CVE-2026-57309/57310 chain -- to upload arbitrary files, including PHP scripts, to the web root. NVD scored this CVSS 4.0 5.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L). If the uploaded PHP file is placed in a web-accessible, PHP-interpreter-enabled directory, requesting it directly achieves remote code execution under the web server's identity, enabling a classic CMS webshell foothold.
As of this writing, none of the three CVEs appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit code, exploit-kit module, or in-the-wild exploitation report has been identified. Exploitability is therefore assessed as PoC-not-yet-public / theoretical-to-emerging rather than actively weaponized, but the trivial nature of blind SQLi discovery/exploitation with modern tooling (sqlmap), the large (10,000+ site) install base, the absence of vendor patch, and the fact CERT Polska could not reach the vendor for remediation together make rapid opportunistic scanning and exploitation plausible once the advisory (and this record) circulate. Defenders operating Windu CMS 4.1 or unknown/unpatched versions should treat this as an urgent, unauthenticated, network-reachable exposure requiring compensating controls (WAF SQLi rules, upload-directory PHP-execution disablement, credential rotation, hash re-salting) in the
Weaknesses (CWE)
CWE-89, CWE-916, CWE-434
Target sectors: government administration, news - media, professional-services, retail, hospitality, non-profit organisation, education
Target regions: poland, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-57309, CVE-2026-57310, CVE-2026-57311, T1595.002, T1588.005, T1190, T1078, T1203, T1059.004, T1505.003, T1136.001, T1068, T1036.005