Windu CMS Patches Three Chained Vulnerabilities
CERT Polska disclosed three Windu CMS flaws—blind SQLi, weak password hashing, and unrestricted file upload—that can chain to remote code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of three vulnerabilities in Windu CMS version 4.1, which may also affect other versions. CVE-2026-57309 is a blind SQL injection in the HTTP header URL path that can be exploited by an unauthenticated remote attacker. CVE-2026-57310 concerns weak password storage using MD5 and SHA1 with a static salt, making stolen hashes crackable. CVE-2026-57311 is an unrestricted file upload flaw allowing an authenticated attacker to upload arbitrary files, including PHP, leading to remote code execution.
While no active exploitation is reported, the combination of an unauthenticated SQLi entry point, weak credential hashing, and an authenticated file upload path to RCE represents a plausible attack chain: an attacker could use the SQLi to extract credentials, crack them due to the weak hashing scheme, then leverage authenticated access to upload a webshell. This is a standard coordinated vulnerability disclosure advisory with no indication of in-the-wild attacks.
Mentioned in this report
Detection guidance
SQL Injection Pattern in HTTP Request Header or URL Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects common SQL injection syntax (UNION SELECT, SLEEP, boolean-based payloads) appearing in HTTP headers or URL path rather than query string, matching the blind SQLi-via-header vector described in the advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Pattern in HTTP Request Header or URL Path
description: Detects SQL injection syntax embedded in HTTP request headers (e.g. User-Agent,
Referer, X-Forwarded-For) or the URL path segment rather than the query string.
This matches header/path-based blind SQLi entry points such as CVE-2026-57309, which
bypasses input filters that only validate GET/POST parameters.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- UNION SELECT
- union select
- SLEEP(
- sleep(
- ''' OR ''1''=''1'
- 1=1--
- benchmark(
header_selection:
cs-referer|contains:
- UNION SELECT
- SLEEP(
- ''' OR ''1''=''1'
ua_selection:
cs-user-agent|contains:
- UNION SELECT
- SLEEP(
- ''' OR ''1''=''1'
condition: 1 of selection or header_selection or ua_selection
falsepositives:
- Vulnerability scanners and pentest tools intentionally probing for SQLi
- Security research/bug bounty traffic against the same application
level: medium
id: fcee5ded-3448-569e-b05a-75f8eb8ad743
status: experimental
author: Vorant
PHP Web Shell File Written via CMS Upload Handler
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a PHP (or other server-executable) file inside a web application upload/media directory by the web server process, consistent with exploitation of an unrestricted file upload vulnerability to plant a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Web Shell File Written via CMS Upload Handler
description: Detects a web-server or PHP-FPM process writing a .php/.phtml/.php5 file
into a typical CMS upload or media directory. This generalises the unrestricted-upload-to-RCE
chain (e.g. CVE-2026-57311) where an authenticated attacker abuses an upload endpoint
intended for images/documents to drop executable script content.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php-cgi.exe
- \php.exe
- \httpd.exe
- \nginx.exe
- \w3wp.exe
TargetFilename|contains:
- \uploads\
- \upload\
- \media\
- \files\
TargetFilename|endswith:
- .php
- .phtml
- .php5
- .phar
filter_known_deploy:
TargetFilename|contains: \vendor\
condition: selection and not filter_known_deploy
falsepositives:
- Legitimate plugin/theme installers that place PHP files under upload-like paths
during CMS administration
- CI/CD or deployment pipelines that push application code through the web server
user
level: high
id: 672f8a70-2e5e-5231-9bdd-b04924f7351e
status: experimental
author: Vorant
Web Server Process Spawning Command Interpreter (Web Shell Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP process spawning a shell/command interpreter, the典型 behaviour once an uploaded web shell is invoked to execute attacker commands following exploitation of the upload vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Interpreter (Web Shell Execution)
description: Detects web-server/PHP worker processes spawning cmd.exe, powershell.exe,
or sh/bash-equivalents on Windows, a strong indicator that an uploaded web shell
(e.g. following exploitation of CVE-2026-57311) is being used to execute arbitrary
commands.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \httpd.exe
- \nginx.exe
- \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
filter_admin_scripts:
CommandLine|contains:
- C:\inetpub\wwwroot\healthcheck
condition: selection and not filter_admin_scripts
falsepositives:
- Custom application admin scripts that legitimately shell out from PHP (rare, should
be inventoried)
- Monitoring/health-check tools that invoke command-line utilities from the web server
context
level: high
id: eb49dceb-a7d4-5d9d-8242-44311a9d6696
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-57309
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs