CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload)

CVE-2026-57309 (TL-2026-1568) is a high-severity software vulnerability scored CVSS 9.3, first published 2026-07-20. It has no confirmed attribution, affects JCD Windu CMS, references 3 CVEs (CVE-2026-57309, CVE-2026-57310, CVE-2026-57311), maps to 22 MITRE ATT&CK techniques (T1003, T1005, T1036.005), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1568

Threat ID
TL-2026-1568
Severity
HIGH
CVSS
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-20
Last reviewed
2026-07-20
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, news - media, professional-services, retail, hospitality, non-profit organisation, education
Target regions
poland, Europe
Detection rules
9
Indicators of compromise
16

CERT Polska disclosed three vulnerabilities in JCD's Windu CMS 4.1: CVE-2026-57309, an unauthenticated blind SQL injection via the HTTP URL path/header (CWE-89, CVSS 4.0 9.3 CRITICAL); CVE-2026-57310, MD5/SHA1-with-static-salt password hashing (CWE-916, CVSS 6.3); and CVE-2026-57311, an authenticated unrestricted file upload enabling PHP webshell RCE (CWE-434, CVSS 5.3). Chained, an unauthenticated attacker can exfiltrate the password store via SQLi, crack weakly-salted hashes offline, authenticate, and upload a PHP webshell for full remote code execution. Windu CMS reportedly powers over 10,000 Polish and international websites; the vendor did not respond to CERT Polska's coordinated disclosure contact attempts, so no patched version exists as of publication.

How CVE-2026-57309 works

On 20 July 2026, CERT Polska (CERT.PL) published a coordinated vulnerability disclosure covering three flaws in Windu CMS version 4.1, a Twitter-Bootstrap-based content management system developed by the Polish interactive agency JCD (jcd.pl), reportedly deployed on more than 10,000 websites in Poland and abroad. The vulnerabilities were reported directly to CERT Polska by researchers Jakub Lipinski, Marek Tolczyk, and Kamil Krolikowski, and CERT Polska's attempts to contact the vendor for coordinated remediation were unsuccessful, meaning no fixed version or patch has been published at time of writing.

CVE-2026-57309 is the most severe of the three: a blind SQL injection (CWE-89) reachable by a remote, unauthenticated attacker who injects SQL syntax into the URL path as reflected through an HTTP header. NVD scored it CVSS 4.0 9.3 (CRITICAL, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N), reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality/integrity impact on the vulnerable component with low availability impact. Blind SQLi of this kind is typically exploited via boolean-based or time-based inference (e.g., SLEEP()/BENCHMARK() timing oracles, or conditional response-length/content differences) to enumerate database contents -- most critically the user credential table -- without needing a UNION-based or error-based response leak.

CVE-2026-57310 compounds the SQLi impact: Windu CMS stores user passwords hashed with MD5 and/or SHA1 combined with a static (non-per-user, non-rotating) salt (CWE-916, Insufficient Computational Effort). A static salt defeats the purpose of salting -- it does not prevent rainbow-table or bulk dictionary/brute-force attacks across the full user base once hashes are exfiltrated, since every hash uses the identical salt value baked into the application. NVD scored this CVSS 4.0 6.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). Combined with CVE-2026-57309, an unauthenticated attacker can blind-SQLi the users table, dump the MD5/SHA1+static-salt hashes, and crack them at scale offline (GPU-accelerated hashcat/John the Ripper against MD5/SHA1 is trivial and fast) to recover plaintext admin/user credentials.

CVE-2026-57311 provides the privilege-escalation and code-execution capstone: Windu CMS's authenticated file-upload functionality does not validate uploaded file types (CWE-434, Unrestricted Upload of File with Dangerous Type), permitting an authenticated user -- including credentials recovered via the CVE-2026-57309/57310 chain -- to upload arbitrary files, including PHP scripts, to the web root. NVD scored this CVSS 4.0 5.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L). If the uploaded PHP file is placed in a web-accessible, PHP-interpreter-enabled directory, requesting it directly achieves remote code execution under the web server's identity, enabling a classic CMS webshell foothold.

As of this writing, none of the three CVEs appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit code, exploit-kit module, or in-the-wild exploitation report has been identified. Exploitability is therefore assessed as PoC-not-yet-public / theoretical-to-emerging rather than actively weaponized, but the trivial nature of blind SQLi discovery/exploitation with modern tooling (sqlmap), the large (10,000+ site) install base, the absence of vendor patch, and the fact CERT Polska could not reach the vendor for remediation together make rapid opportunistic scanning and exploitation plausible once the advisory (and this record) circulate. Defenders operating Windu CMS 4.1 or unknown/unpatched versions should treat this as an urgent, unauthenticated, network-reachable exposure requiring compensating controls (WAF SQLi rules, upload-directory PHP-execution disablement, credential rotation, hash re-salting) in the absence of an official patch.

MITRE ATT&CK techniques used in TL-2026-1568

Credential Access

T1003 OS Credential Dumping; T1110.002 Password Cracking; T1212 Exploitation for Credential Access

Collection

T1005 Data from Local System; T1119 Automated Collection

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087.001 Local Account; T1518 Software Discovery

Command and Control

T1102 Web Service

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Impact

T1491.002 External Defacement; T1565.001 Stored Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-57309

  • JCD — Windu CMS
    Vulnerable versions: 4.1; possibly other unconfirmed versions per CERT.PL

Remediation for CVE-2026-57309

Patches

  • No vendor patch available as of 2026-07-20; CERT Polska's vendor contact attempts for coordinated disclosure were unsuccessful

Immediate actions

  • Deploy a WAF/reverse-proxy rule blocking SQL-injection-pattern strings in the URL path and HTTP headers in front of any Windu CMS instance
  • Disable PHP (and other server-side script) execution in all upload directories via web-server configuration (e.g., Apache disable_functions/php_flag engine off, Nginx location block denying .php execution)
  • Restrict authenticated file-upload endpoints to an explicit MIME/extension allowlist (images/documents only) with server-side content-type verification, not just extension checks
  • Force a password reset and re-salt/re-hash all user credentials with a modern algorithm (bcrypt/scrypt/Argon2) and per-user random salts
  • Enable verbose SQL/application logging and monitor for repeated boolean/time-based injection probe patterns against CMS endpoints
  • Take internet-facing Windu CMS 4.1 instances offline or place behind authenticated VPN access until a vendor fix is available

Workarounds

  • WAF rule blocking SQLi-pattern payloads in URL path and headers (mitigates CVE-2026-57309)
  • Disable script execution in upload directories at the web-server level (mitigates CVE-2026-57311)
  • Force credential rotation and re-hash with a modern KDF (mitigates downstream impact of CVE-2026-57310)

Longer-term hardening

  • Migrate off Windu CMS to an actively maintained CMS platform with a responsive vendor security process, given JCD did not respond to CERT Polska's coordinated disclosure contact
  • Adopt parameterized queries / prepared statements and an ORM layer across all CMS database access paths
  • Implement centralized, modern credential hashing (Argon2id) with per-user salts and periodic re-hash-on-login migration
  • Establish a secure file-upload architecture: store uploads outside the web root or in a non-executable bucket/object store, serve via a signed-URL proxy
  • Deploy a network-layer database activity monitoring / anomaly detection solution to catch future SQLi against the CMS database tier
  • Track Windu CMS in asset inventory and subscribe to CERT Polska / NVD feeds for a future vendor patch

CVEs associated with CVE-2026-57309

CVE-2026-57309, CVE-2026-57310, CVE-2026-57311

Weaknesses (CWE) in CVE-2026-57309

CWE-89, CWE-916, CWE-434

Timeline of CVE-2026-57309

  • Windu CMS 4.1 in active deployment across 10,000+ Polish and international websites prior to disclosure (exact release date not published by vendor).
  • Researchers Jakub Lipinski, Marek Tolczyk, and Kamil Krolikowski report CVE-2026-57309, CVE-2026-57310, and CVE-2026-57311 directly to CERT Polska (approximate date; CERT.PL's exact intake date not published in the advisory).
  • CERT Polska attempts coordinated-disclosure contact with JCD (Windu CMS vendor) under its CVD policy; contact attempts are unsuccessful and no vendor response is obtained.
  • CERT Polska's advisory states all three vulnerabilities are confirmed in Windu CMS version 4.1 but 'may also affect other versions,' which could not be verified because JCD did not respond to coordinated-disclosure contact -- widening the plausible affected install base beyond the confirmed 4.1 baseline.
  • No vendor patch or fixed version is published for Windu CMS as of the disclosure date; defenders must rely on compensating controls (WAF rules, upload-directory execution disablement, credential rotation).
  • CISA Known Exploited Vulnerabilities catalog checked; none of the three CVEs are listed, and no public exploitation reports are identified as of this date.
  • NVD publishes CVSS 4.0 scores: CVE-2026-57309 at 9.3 (CRITICAL), CVE-2026-57310 at 6.3 (MEDIUM), and CVE-2026-57311 at 5.3 (MEDIUM), with CWE-89, CWE-916, and CWE-434 mappings respectively.
  • CERT Polska publicly publishes the advisory for CVE-2026-57309 (blind SQL injection), alongside companion disclosures CVE-2026-57310 (weak MD5/SHA1 static-salt password hashing) and CVE-2026-57311 (unrestricted file upload / RCE).

Sources cited for CVE-2026-57309

Threats related to CVE-2026-57309

Detection coverage for TL-2026-1568

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1568 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats