# CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload)

> CERT Polska disclosed three vulnerabilities in JCD's Windu CMS 4.1: CVE-2026-57309, an unauthenticated blind SQL injection via the HTTP URL path/header (CWE-89, CVSS 4.0 9.3 CRITICAL); CVE-2026-57310, MD5/SHA1-with-static-salt password hashing (CWE-916, CVSS 6.3); and CVE-2026-57311, an authenticated unrestricted file upload enabling PHP webshell RCE (CWE-434, CVSS 5.3). Chained, an unauthenticated attacker can exfiltrate the password store via SQLi, crack weakly-salted hashes offline, authenticate, and upload a PHP webshell for full remote code execution. Windu CMS reportedly powers over 10,000 Polish and international websites; the vendor did not respond to CERT Polska's coordinated disclosure contact attempts, so no patched version exists as of publication.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1568
- **ID:** TL-2026-1568
- **Severity:** HIGH (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-57309, CVE-2026-57310, CVE-2026-57311

## Description

On 20 July 2026, CERT Polska (CERT.PL) published a coordinated vulnerability disclosure covering three flaws in Windu CMS version 4.1, a Twitter-Bootstrap-based content management system developed by the Polish interactive agency JCD (jcd.pl), reportedly deployed on more than 10,000 websites in Poland and abroad. The vulnerabilities were reported directly to CERT Polska by researchers Jakub Lipinski, Marek Tolczyk, and Kamil Krolikowski, and CERT Polska's attempts to contact the vendor for coordinated remediation were unsuccessful, meaning no fixed version or patch has been published at time of writing.

CVE-2026-57309 is the most severe of the three: a blind SQL injection (CWE-89) reachable by a remote, unauthenticated attacker who injects SQL syntax into the URL path as reflected through an HTTP header. NVD scored it CVSS 4.0 9.3 (CRITICAL, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N), reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality/integrity impact on the vulnerable component with low availability impact. Blind SQLi of this kind is typically exploited via boolean-based or time-based inference (e.g., SLEEP()/BENCHMARK() timing oracles, or conditional response-length/content differences) to enumerate database contents -- most critically the user credential table -- without needing a UNION-based or error-based response leak.

CVE-2026-57310 compounds the SQLi impact: Windu CMS stores user passwords hashed with MD5 and/or SHA1 combined with a static (non-per-user, non-rotating) salt (CWE-916, Insufficient Computational Effort). A static salt defeats the purpose of salting -- it does not prevent rainbow-table or bulk dictionary/brute-force attacks across the full user base once hashes are exfiltrated, since every hash uses the identical salt value baked into the application. NVD scored this CVSS 4.0 6.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). Combined with CVE-2026-57309, an unauthenticated attacker can blind-SQLi the users table, dump the MD5/SHA1+static-salt hashes, and crack them at scale offline (GPU-accelerated hashcat/John the Ripper against MD5/SHA1 is trivial and fast) to recover plaintext admin/user credentials.

CVE-2026-57311 provides the privilege-escalation and code-execution capstone: Windu CMS's authenticated file-upload functionality does not validate uploaded file types (CWE-434, Unrestricted Upload of File with Dangerous Type), permitting an authenticated user -- including credentials recovered via the CVE-2026-57309/57310 chain -- to upload arbitrary files, including PHP scripts, to the web root. NVD scored this CVSS 4.0 5.3 (MEDIUM, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L). If the uploaded PHP file is placed in a web-accessible, PHP-interpreter-enabled directory, requesting it directly achieves remote code execution under the web server's identity, enabling a classic CMS webshell foothold.

As of this writing, none of the three CVEs appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit code, exploit-kit module, or in-the-wild exploitation report has been identified. Exploitability is therefore assessed as PoC-not-yet-public / theoretical-to-emerging rather than actively weaponized, but the trivial nature of blind SQLi discovery/exploitation with modern tooling (sqlmap), the large (10,000+ site) install base, the absence of vendor patch, and the fact CERT Polska could not reach the vendor for remediation together make rapid opportunistic scanning and exploitation plausible once the advisory (and this record) circulate. Defenders operating Windu CMS 4.1 or unknown/unpatched versions should treat this as an urgent, unauthenticated, network-reachable exposure requiring compensating controls (WAF SQLi rules, upload-directory PHP-execution disablement, credential rotation, hash re-salting) in the absence of an official patch.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1136.001 Local Account
- T1068 Exploitation for Privilege Escalation
- T1036.005 Match Legitimate Resource Name or Location
- T1070.003 Clear Command History
- T1212 Exploitation for Credential Access
- T1003 OS Credential Dumping
- T1110.002 Password Cracking
- T1518 Software Discovery
- T1087.001 Local Account
- T1005 Data from Local System
- T1119 Automated Collection
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1491.002 External Defacement
- T1565.001 Stored Data Manipulation

## Sources

- [CVE-2026-57309: Blind SQL Injection in Windu CMS](https://cert.pl/en/posts/2026/07/CVE-2026-57309/)
- [NVD - CVE-2026-57309 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-57309)
- [NVD - CVE-2026-57310 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-57310)
- [NVD - CVE-2026-57311 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-57311)
- [Windu - autorski system CMS (vendor product page, JCD.pl)](https://jcd.pl/windu-autorski-system-cms)
- [Windu CMS official site](https://windu.org/)
- [CISA Known Exploited Vulnerabilities Catalog (checked, no match)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1568