Exploit catalog results

Showing 11 PoCs on this page

GitHub

webshellseo8/CVE-2026-12720-Proof-of-Concept

Repository PoCStars: 0Created 2026-08-04
Model review verdict: Suspicious behavior.StubCVE-2026-127202 files

5.0 KiB

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script and README that describe CVE-2026-12720 but contain only a placeholder payload and no functional exploit or scanner logic. The script prints vulnerability information and a hardcoded illustrative serialized string, then exits. It does not connect to a target, send a payload, or verify vulnerability status.

Backdoor review

Suspicious behavior

The Python script is a harmless simulation that prints a placeholder payload and does not perform any network activity or exploitation. However, the README.md materially misrepresents the script's capabilities, claiming it is a 'functional demonstration script' with 'Automated Verification' and 'Customizable Payloads', which directly contradicts the script's actual behavior. This deception about the artifact's functionality raises concern about the operator's intent.

ClassificationStub
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarekirki wordpress plugin
Attack typesphp object injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script contains no code to connect to a target, send a payload, or check for vulnerability. It only prints a placeholder payload and describes the vulnerability. The README claims 'Automated Verification' and 'Customizable Payloads' but the provided Python file implements none of these features. The artifact is materially incomplete for exploitation or scanning.

CVE-2026-12720.py:1-90README.md:19-21

Requirements

  • User must type 'yes' to proceed to the simulation step.CVE-2026-12720.py:80-81

Observed behavior

  • Prints a disclaimer and vulnerability information.CVE-2026-12720.py:36-58
  • Displays a hardcoded placeholder serialized payload without sending it to any target.CVE-2026-12720.py:34CVE-2026-12720.py:61-72
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Deceptive Documentation
  • The README.md describes the artifact as a 'functional demonstration script' with features like 'Automated Verification' and 'Customizable Payloads', but the provided Python script (CVE-2026-12720.py) contains no such functionality; it only prints a hardcoded placeholder payload and requires no target input.README.md:13README.md:19-21CVE-2026-12720.py:61-72

Observables

Url
Payload withheldA Telegram channel URL embedded in the script as the 'Source' of vulnerability information. It is displayed to the user but not used for any network communication within the provided code.CVE-2026-12720.py:32
Review boundaries

What the analysis did not establish

  • The README describes features (Automated Verification, Customizable Payloads) not present in the supplied Python file.
  • The Python file contains only a placeholder payload and no network operations.
  • Only the two text files (CVE-2026-12720.py and README.md) were reviewed. No other files, dependencies, or network behavior were analyzed.
  • The review cannot determine if the Telegram channel URL is malicious or if the repository contains hidden branches or tags with different content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-57811-Proof-of-Concept

Repository PoCStars: 0Created 2026-07-29
WriteupCVE-2026-578111 file

2.0 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that provides an overview of CVE-2026-57811, a code injection vulnerability in the Realtyna Organic IDX plugin for WordPress. It describes the vulnerability, its potential impact (unauthenticated RCE), and the purpose of a Proof of Concept for validation, but explicitly states that the complete PoC is not published in the repository. The file contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a single README.md file that describes the CVE-2026-57811 vulnerability and states that the complete PoC is not published. No executable code, obfuscated payloads, or instructions to execute anything are present. The file includes a link to a Telegram channel, which is a common promotional tactic but does not constitute backdoor behavior within the artifact itself.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareWordPressRealtyna Organic IDX plugin
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file containing a technical analysis and overview of CVE-2026-57811. It explicitly states 'The complete PoC is not published in this repository' and contains no exploit or scanner code, making it a writeup.

README.md:30

Requirements

  • Target must be running a vulnerable version of the Realtyna Organic IDX plugin (<= 5.2.0).README.md:9

Observed behavior

  • The file describes the vulnerability and the intended use of a PoC for verification, but does not contain or execute any code.README.md:15-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Telegram Link
Payload withheldThe README promotes a Telegram channel for exploit updates. This is a common social-engineering or lead-generation tactic in PoC repositories but does not, by itself, demonstrate backdoor or malicious behavior within the supplied artifact.README.md:37-44
Review boundaries

What the analysis did not establish

  • Only one file (README.md) was provided; no other source code or binaries were included.
  • The artifact explicitly states the complete PoC is not published, so no functional code is available for analysis.
  • Only the README.md file was provided; no other files exist in the repository snapshot. The artifact's own statement that the complete PoC is not published is taken at face value, but no evidence of hidden or omitted content is present in the supplied data.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-50522-Proof-of-Concept

Repository PoCStars: 0Created 2026-07-29
Model review verdict: Suspicious behavior.WriteupCVE-2026-505221 file

2.1 KiB

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that provides a vulnerability overview, technical analysis, and mitigation guidance for CVE-2026-50522. It explicitly states that the complete PoC is not published in the repository and contains no exploit or scanner code.

Backdoor review

Suspicious behavior

The repository claims to be a Proof of Concept for CVE-2026-50522 but explicitly states 'The complete PoC is not published in this repository.' The only content is a README that directs users to a Telegram channel ('payload withheld') for 'the latest vulnerability research, exploit analysis, Proofs of Concept.' This is a material contradiction: the artifact is presented as a PoC but contains no exploit code, instead serving as a lure to an external, uninspected communication channel. The absence of any PoC code and the redirection to an external channel for the actual exploit is a deceptive practice that creates concern about the operator's intent.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdown
Target softwareMicrosoft SharePoint Server
Attack typesDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file containing a vulnerability overview, technical analysis, and mitigation guidance. It explicitly states 'The complete PoC is not published in this repository' and contains no executable code, making it a writeup.

README.md:31README.md:53-57

Observed behavior

  • The document describes the vulnerability, its CVSS score, and intended use for authorized security research, but does not perform any technical action.README.md:7-9README.md:15-23
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Deceptive Marketing
  • The repository is titled 'CVE-2026-50522 – Proof of Concept' but explicitly states 'The complete PoC is not published in this repository.' The artifact contains no exploit code, contradicting its primary advertised purpose and serving only as a lure to an external Telegram channel.README.md:1README.md:31
External Lure
  • The README contains a prominent call-to-action to join a Telegram channel ('payload withheld') for 'the latest vulnerability research, exploit analysis, Proofs of Concept.' This redirects the operator to an uninspected external resource, which is the only apparent purpose of the repository.README.md:35-47

Observables

Url
Payload withheldA Telegram channel URL promoted as the source for 'the latest vulnerability research, exploit analysis, Proofs of Concept,' serving as the only call-to-action in a repository that lacks any PoC code.README.md:38-44
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file; no exploit or scanner source code is present.
  • The artifact's claim of containing a 'Technical analysis' cannot be verified as the analysis content is not provided in the evidence.
  • The content of the external Telegram channel was not inspected, so the nature of any files or instructions distributed there is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2024-1813-Proof-of-Concept

Repository PoCStars: 0Created 2026-07-29
WriteupCVE-2024-18131 file

2.1 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that describes CVE-2024-1813, a PHP Object Injection vulnerability in the Simple Job Board WordPress plugin. It provides an overview, intended audience, and expected outcomes for a Proof of Concept, but explicitly states the PoC code is not hosted in the repository. The file contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a README.md file with vulnerability documentation, a Telegram channel link, and a disclaimer. No executable code, payload, or backdoor behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareSimple Job Board WordPress Plugin
Attack typesPHP Object Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a documentation file (README.md) that provides a technical overview of CVE-2024-1813. It states 'The PoC itself is not hosted in this repository' (line 30) and contains no executable code, making it a writeup rather than an exploit or scanner.

README.md:30

Requirements

  • Target must be running Simple Job Board plugin version <= 2.11.0README.md:7
  • A suitable POP chain must be present via an additional plugin or theme for high impactREADME.md:9

Observed behavior

  • Describes the vulnerability and its potential impact, but does not perform any actionsREADME.md:1-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

External Link
Payload withheldTelegram channel link for security updates; no backdoor behavior in the artifact itself.README.md:37-44
Review boundaries

What the analysis did not establish

  • Evidence consists of a single README.md file; no other source code or files were provided.
  • The artifact explicitly states the PoC is not included, so the actual exploit or scanner code is absent.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot. The PoC itself is stated to be not hosted in this repository, so its behavior cannot be assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-61511-POC

Repository PoCStars: 0Created 2026-07-29
Not analyzedCVE-2026-615111 file
GitHub

webshellseo8/CVE-2026-32488-POC

Repository PoCStars: 0Created 2026-06-16
WriteupCVE-2026-324881 file

1.9 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file describing a tool for mass scanning and exploiting CVE-2026-32488 in the UpdraftPlus WordPress plugin. It contains no exploit or scanner code; it only provides a high-level overview, usage instructions, and output descriptions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a mass scanner and exploit tool for CVE-2026-32488. The file contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform harmful actions. It describes normal exploit behavior against the stated target (WordPress User Registration plugin) and includes standard disclaimers. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdown
Target softwareUpdraftPlus WordPress plugin
Attack typesPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The only file provided is a README.md that describes a tool's features and usage but contains no executable code, exploit logic, or scanner implementation. It is a substantive technical writeup describing the tool's purpose and operation.

README.md:1-59

Requirements

  • Target list of URLs in targets.txtREADME.md:22-23
  • Python 3 and dependencies from requirements.txtREADME.md:41-45

Observed behavior

  • Describes mass scanning of target lists with concurrent workersREADME.md:13
  • Describes auto-exploitation of CVE-2026-32488README.md:14
  • Describes credential and role extraction (admin, file-manager, uploader accounts)README.md:15
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Contact Information
Payload withheldThe README includes contact details for the author, which may be associated with webshell-related activity, but this alone does not constitute backdoor behavior in the reviewed artifact.README.md:54-55
Review boundaries

What the analysis did not establish

  • Only the README.md file is included; the actual Python script (CVE-2026-32488 -mass.py) and requirements.txt are not present.
  • The artifact describes a tool for UpdraftPlus, but the associated CVE context indicates the vulnerability is in the User Registration plugin, creating a discrepancy in target software.
  • Only the README.md file was provided; no source code, scripts, or binary files were included in the evidence packet. The actual behavior of the referenced tool cannot be assessed.
  • The analysis scope indicates that no executable source was identified and binary files were not analyzed, so the review is limited to the documentation text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-53787-POC-

Repository PoCStars: 0Created 2026-06-14
Not analyzedCVE-2026-537871 file
GitHub

webshellseo8/CVE-2026-1555-POC

Repository PoCStars: 0Created 2026-06-13
ScannerCVE-2026-15551 file

745 B

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file describing a scanner script for CVE-2026-1555. It provides a command-line usage example that reads a list of targets and saves confirmed vulnerable hosts to a file, indicating a scanning and validation operation rather than a direct exploit.

Backdoor review

Backdoor review undetermined

The supplied evidence consists solely of a README.md file describing a PoC for CVE-2026-1555. The README mentions a Python script (payload withheld) but the script itself is not included in the evidence. Without the actual executable code, it is impossible to determine whether the PoC contains backdoor behavior. The README's description of the exploit target (SP Pagebuilder for Joomla) contradicts the CVE description (WebStack theme for WordPress), which is a material inconsistency but does not, by itself, constitute evidence of a backdoor against the operator. No executable behavior can be reviewed.

ClassificationScanner
Model confidence90%
AuthenticationNot required
LanguagesPython
Target softwareSP PagebuilderJoomla
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README describes a script that takes a list of targets and outputs 'confirmed shells' to a file, which is characteristic of a vulnerability scanner that validates exposure. The script itself is not provided, but the described behavior is scanning, not direct exploitation.

README.md:22-25

Requirements

  • A list of target URLs or IPs in a file named targets.txtREADME.md:22

Observed behavior

  • Executes a Python script that reads targets from a file and saves confirmed vulnerable hosts to webshell.txtREADME.md:22-25
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Mismatch
Payload withheldThe README title and overview reference a different product and platform than the associated CVE record, indicating a potential misrepresentation or error in the PoC's documentation.README.md:1README.md:15
Missing Executable
Payload withheldThe README references a Python script as the PoC, but this file is not included in the evidence packet, preventing any analysis of its behavior.README.md:22
Review boundaries

What the analysis did not establish

  • Only the README.md file is provided; the actual Python script (payload withheld) is not included, so the exact scanning logic cannot be verified.
  • The README title references CVE-2026-1555 but the usage example references a different CVE (CVE-2026-48908), creating ambiguity about the target vulnerability.
  • The evidence packet contains only the README.md file. The referenced Python script (payload withheld) and any other source files are not included, making a complete review impossible.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-10795-POC

Repository PoCStars: 0Created 2026-06-11
ExploitCVE-2026-107952 files

14.4 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 script that exploits CVE-2026-10795 (authentication bypass in UpdraftPlus) to create an administrator account, upload a malicious plugin containing a web shell, and activate it, achieving remote code execution on vulnerable WordPress sites.

Backdoor review

No backdoor observed in reviewed code

The PoC is a mass scanner and auto-exploit for CVE-2026-10795. It exploits an authentication bypass in the UpdraftPlus WordPress plugin to create an administrator account and upload a webshell. All actions are consistent with the disclosed exploit and the tool's documented purpose. No concealed, unrelated, or misrepresented harmful behavior was found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareUpdraftPlus WordPress plugin
Attack typesauthentication bypassremote code executionwebshell upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by forging RPC messages to create an admin user, upload a web shell plugin, and activate it, resulting in remote code execution. It does not merely detect or report the vulnerability.

CVE-2026-10795-mass.py:1-5CVE-2026-10795-mass.py:170-224

Requirements

  • A list of target URLs in a file (targets.txt).CVE-2026-10795-mass.py:229-236
  • Python 3 with requests, pycryptodome, colorama, and urllib3 libraries.CVE-2026-10795-mass.py:10-28

Observed behavior

  • Sends a forged RPC message to the target's admin-ajax.php endpoint using a zeroed AES key to bypass signature verification.CVE-2026-10795-mass.py:98-125
  • Creates a new administrator user named 'WebshellRS' on the target WordPress site via the 'users.add_user' RPC command.CVE-2026-10795-mass.py:138-150
  • Generates a malicious WordPress plugin ZIP containing a PHP web shell with file upload capability.CVE-2026-10795-mass.py:63-77
  • Uploads the malicious plugin via the 'plugin.upload_plugin' RPC command and activates it via 'plugin.activate_plugin'.CVE-2026-10795-mass.py:153-167
  • Saves the created admin credentials to 'admins.txt' and the web shell URL to 'uploaders.txt'.CVE-2026-10795-mass.py:200-224
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell
Payload withheldThis is the PHP webshell uploaded to the target as part of the disclosed exploit. It provides a file upload form and is the intended RCE payload.CVE-2026-10795-mass.py:65-73
Admin Credentials
Payload withheldThe PoC creates a hardcoded administrator account on the target. This is the disclosed privilege escalation step of the exploit.CVE-2026-10795-mass.py:47
Contact Information
Payload withheldThe PoC includes contact information for the authors, which is displayed in the banner and embedded in the uploaded webshell. This is not a backdoor indicator.CVE-2026-10795-mass.py:6-7CVE-2026-10795-mass.py:51
Review boundaries

What the analysis did not establish

  • The evidence is limited to the source code and README; no runtime output, network captures, or target interaction logs are provided.
  • The artifact's behavior is inferred from static analysis of the Python script; no dynamic execution or verification was performed.
  • The review is limited to the two provided text files. No external dependencies or network behavior at runtime were analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-48907-Unauthenticated-RCE-in-JCE

Repository PoCStars: 1Created 2026-06-09
ScannerCVE-2026-489072 files

10.5 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python mass scanner that checks for CVE-2026-48907 in JCE Joomla by attempting to create a profile, upload a PHP webshell, and verify remote code execution via an HTTP request. It saves only confirmed vulnerable URLs.

Backdoor review

No backdoor observed in reviewed code

The PoC is a mass scanner for CVE-2026-48907 that uploads PHP webshells to vulnerable Joomla JCE targets. All payloads are standard PHP backticks or system() calls consistent with the stated RCE exploit. No concealed operator-directed harm, credential theft, persistence, or unrelated payloads were observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareJoomla Content Editor (JCE) extension for Joomla
Attack typesRemote Code ExecutionCode InjectionImproper Access Control
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script is described as a 'Mass Scanner' in its docstring and banner. It checks for the vulnerability by attempting exploitation steps (profile import, upload, rename) but its primary stated purpose is to detect and report vulnerable targets, saving only confirmed RCE URLs. It does not provide an interactive shell or post-exploitation capabilities; it validates the vulnerability and exits.

CVE-2026-48907.py:3CVE-2026-48907.py:9CVE-2026-48907.py:230CVE-2026-48907.py:249

Requirements

  • Target must have JCE extension installed and accessible.CVE-2026-48907.py:84-91
  • Target must expose the JCE proxy endpoint.CVE-2026-48907.py:93-95
  • Target must provide a CSRF token in the homepage or a form.CVE-2026-48907.py:97-104

Observed behavior

  • Checks for JCE presence by requesting known plugin paths and looking for version XML.CVE-2026-48907.py:25-30CVE-2026-48907.py:84-91
  • Imports a malicious JCE profile via XML upload to enable file upload and rename features.CVE-2026-48907.py:106-132
  • Uploads PHP payloads directly as .php files and verifies execution by requesting the file with a command parameter.CVE-2026-48907.py:159-175
  • Uploads GIF payloads as .gif files, then renames them to .php via JSON-RPC and verifies execution.CVE-2026-48907.py:177-198
  • Saves confirmed RCE URLs to an output file.CVE-2026-48907.py:59-64CVE-2026-48907.py:216-218
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Payload
Payload withheldStandard PHP backtick webshell used to demonstrate RCE on the target.CVE-2026-48907.py:33
Output File
Payload withheldFile where confirmed RCE URLs are saved; consistent with scanner output.CVE-2026-48907.py:22
Contact Info
Payload withheldAuthor contact information; not a backdoor indicator.CVE-2026-48907.py:7
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code; no runtime behavior or network traffic was observed.
  • The artifact is self-described as a PoC and scanner, but classification is based solely on its code and documentation.
  • Only the two text files (CVE-2026-48907.py and README.md) were reviewed; no binary or other files were present in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

webshellseo8/CVE-2026-21628-POC

Repository PoCStars: 0Created 2026-04-02
Model review verdict: Suspicious behavior.ExploitCVE-2026-216288 files

25.8 KiB

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-21628 in Astroid Framework for Joomla to achieve unauthenticated remote code execution by uploading a webshell via the media upload endpoint and optionally using an installTemplate fallback.

Backdoor review

Suspicious behavior

The PoC exploits CVE-2026-21628 to upload a webshell. It contains a fallback method (installTemplate) that instructs the target server to download and install a ZIP from a hardcoded external URL (payload withheld). The ZIP's contents are not provided for review, and the PoC's own documentation does not disclose that this fallback fetches an uninspected remote payload. This concealment of a critical operator-run code path creates concern, but without the ZIP's contents, concealed harm is not directly established.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareAstroid Template FrameworkJoomla
Attack typesRemote Code ExecutionUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads and executes a webshell on a remote target, which constitutes exploitation. It does not merely detect the vulnerability; it performs the full attack chain (upload, rename, verify execution) and includes a fallback exploitation method.

CVE-2026-21628.py:238-297CVE-2026-21628.py:300-333CVE-2026-21628.py:337-349CVE-2026-21628.py:400-454

Requirements

  • Target must be running a vulnerable version of Astroid Framework (2.0.0-3.3.10) on Joomla.CVE-2026-21628.py:3
  • Target must have the Astroid media upload endpoint accessible at /administrator/index.php.CVE-2026-21628.py:247-249
  • A valid CSRF token must be obtainable from the target's administrator login page.CVE-2026-21628.py:217-234

Observed behavior

  • Fetches a CSRF token from the target's /administrator/ page.CVE-2026-21628.py:217-234
  • Uploads a PHP webshell disguised as an SVG file via the Astroid media upload AJAX endpoint.CVE-2026-21628.py:238-297
  • Renames the uploaded .svg file to .php (or other executable extensions) using the media rename endpoint.CVE-2026-21628.py:300-333
  • Verifies successful webshell execution by checking for a unique marker in the HTTP response.CVE-2026-21628.py:337-349
  • If the primary upload/rename method fails, attempts a fallback installTemplate method that drops a webshell via a malicious ZIP file.CVE-2026-21628.py:400-454
  • Saves successfully exploited URLs to a local file (upload.txt).CVE-2026-21628.py:457-460
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Remote Payload
  • The installTemplate fallback method instructs the target server to download and install a ZIP archive from a hardcoded external URL (payload withheld). The contents of this ZIP are not included in the repository, and the PoC's documentation does not disclose that this fallback fetches an uninspected remote payload. The operator cannot review what code will be executed on the target.CVE-2026-21628.py:160-161CVE-2026-21628.py:400-454

Observables

Url
Payload withheldHardcoded external URL used by the installTemplate fallback to fetch a ZIP payload for installation on the target server.CVE-2026-21628.py:160
Url
Payload withheldPromotional link in the script's docstring and README, indicating the author's commercial interest in webshells.CVE-2026-21628.py:9README.md:4
Review boundaries

What the analysis did not establish

  • Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were not inspected; their content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files in the repository were included in the analysis.
  • The contents of the remote ZIP archive at payload withheld are not included in the repository and were not reviewed.
  • Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were flagged as binary and not analyzed; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.