imbas007/POC-CVE-2026-58048

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based exploit for CVE-2026-58048, a SQL injection vulnerability in cPanel. It provides a class `CVE202658048Exploit` that automates the attack chain: authenticating to cPanel, setting the SQL mode to ANSI_QUOTES, creating a database, and renaming it with a crafted name containing a backtick to inject arbitrary SQL that executes as MySQL root. The code includes multiple payload presets for creating admin users, writing webshells, reading files, and executing OS commands.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Python PoC script (poc.py), and a requirements file for CVE-2026-58048. The PoC demonstrates a SQL injection vulnerability in cPanel's database rename functionality. It uses standard Python libraries (requests, pymysql, rich) to interact with cPanel APIs and MySQL, and includes a simulation mode. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated remote access were observed. The code's purpose aligns with the described vulnerability and does not perform any actions beyond the stated exploit and verification.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwarecPanelWP SquaredMySQLMariaDB
Attack typessql injectionprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is `poc.py`, which contains a complete, automated exploit class (`CVE202658048Exploit`) that executes the full attack chain to achieve SQL injection and privilege escalation. It is not merely a scanner or writeup; it actively performs the exploitation steps, including crafting and sending malicious payloads to a target cPanel instance.

poc.py:319-329poc.py:412-543

Requirements

  • Valid cPanel user credentials (username and password or API token) or access to a Docker lab environment.poc.py:71-98poc.py:331-353
  • Ability to connect to the MySQL server associated with the cPanel account to set the session SQL mode.poc.py:383-401poc.py:444-471
  • Target cPanel version must be vulnerable (e.g., < 11.110.0.137).README.md:59

Observed behavior

  • Authenticates to the cPanel API using provided credentials.poc.py:89-98
  • Sets the MySQL session SQL mode to 'ANSI_QUOTES' to disable backtick identifier quoting.poc.py:217-221poc.py:444-471
  • Creates a new database via the cPanel API.poc.py:143-145poc.py:473-486
  • Crafts a malicious database name containing a backtick and injected SQL (e.g., `db`; GRANT ALL ON *.* TO 'rce'@'%' IDENTIFIED BY 'pwned!'; -- `).poc.py:236-270poc.py:488-501
  • Triggers the vulnerability by calling the cPanel rename_database API with the malicious name, causing the injected SQL to execute as MySQL root.poc.py:151-155poc.py:503-512
  • Optionally verifies successful exploitation by connecting to MySQL as the newly created admin user.poc.py:545-568
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Target cPanel URL and MySQL host/port as specified by user argumentsThe PoC connects to user-supplied cPanel and MySQL endpoints to demonstrate the SQL injection. This is expected behavior for a PoC exploit.poc.py:100-132poc.py:192-204
Payload Generation
SQL injection payloads including GRANT ALL, INTO OUTFILE, LOAD_FILE, and UDF executionThese payloads are generated based on user-selected presets or custom SQL input. They are used to demonstrate the impact of the vulnerability (privilege escalation, file write, file read, command execution) and are not executed surreptitiously.poc.py:233-313poc.py:689-729
Simulation Mode
A --simulate flag that demonstrates the injection technique without a real targetThe simulation mode only prints explanatory text and does not make any network connections or modify the local system. It is a safe educational feature.poc.py:581-660
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the contents of `simulate.py` or any Docker-related files, which are referenced in the README but omitted from the selected text.
  • The analysis is based solely on the provided source code and documentation; no dynamic execution or verification of the exploit's effectiveness was performed.
  • Two files (metadata only) were omitted from the text analysis due to size or classification; their content was not reviewed.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1