shinthink/CVE-2026-63223
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python exploit for CVE-2026-63223 that uploads a PHP webshell disguised with image magic bytes to a CodeIgniter 4 endpoint, verifies PHP execution via a unique token, and executes arbitrary commands.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-63223. The Python script (cve_2026_63223.py) implements the documented vulnerability: it builds a PHP webshell with image magic bytes, uploads it to a target, and executes commands. No backdoor, deceptive payload, or concealed operator-directed harm targeting the PoC user was observed. The script's behavior is consistent with the described exploit and does not perform credential theft, persistence, unrelated remote access, or deliver an unrelated payload.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively uploads a malicious PHP file to a target server and executes arbitrary commands, which is the definition of an exploit. The README describes it as a PoC and provides usage examples for exploitation, including single-target and mass-scan modes.
cve_2026_63223.py:1-27cve_2026_63223.py:241-326README.md:142-177Requirements
- Target must be running CodeIgniter 4 < 4.7.4 with a file upload endpoint that uses is_image or mime_in validation without ext_in.
cve_2026_63223.py:6-12 - Uploaded files must be stored in a web-accessible directory where PHP files can execute.
README.md:15-17
Observed behavior
- Detects CodeIgniter 4 by checking HTTP response headers and body for PHP and framework indicators.
cve_2026_63223.py:182-235 - Builds a PHP webshell payload prepended with image magic bytes (GIF, JPEG, or PNG) and a unique verification token.
cve_2026_63223.py:98-126 - Uploads the payload via multipart POST to the target endpoint, then attempts to locate the uploaded file URL from the response or by guessing common paths.
cve_2026_63223.py:241-326 - Verifies PHP execution by checking for the unique token in the response, then executes a supplied system command via the webshell.
cve_2026_63223.py:287-324 - Supports mass scanning of multiple targets with configurable threads and output logging.
cve_2026_63223.py:431-524
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- PHP webshell generation with GIF/JPEG/PNG magic bytes prefixThe script builds a PHP payload that includes a system command execution backdoor, which is the core of the CVE-2026-63223 exploit.
cve_2026_63223.py:104-110 - Network Behavior
- Uploads payload to target endpoint and executes commands via HTTP GETThe script sends the crafted payload to a user-specified target and then accesses it to run commands. This is the intended exploit flow, not a backdoor against the operator.
cve_2026_63223.py:241-326 - Dependency
- requests>=2.28.0, urllib3>=1.26.0Standard HTTP libraries with no suspicious or uncommon packages.
requirements.txt:1-2
What the analysis did not establish
- complete_artifact_coverage is false; 2 unclassified files (1105 bytes) are omitted from the evidence, but the provided text files (README.md, cve_2026_63223.py, requirements.txt) are complete and sufficient for classification.
- Two files (likely .gitignore, LICENSE) were present in the repository but not included as text; their content was not reviewed.
- Binary content was flagged as metadata-only and not analyzed, though no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.