tc4dy/CVE-2026-61511-PoC-Exploit

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full-featured exploit toolkit for CVE-2026-61511, a pre-auth RCE vulnerability in vBulletin. It includes payload generation for reverse shells, webshells, persistence, and various post-exploitation modules, along with a mass scanner.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a Python exploit script (exploit.py) for CVE-2026-61511, a vBulletin eval injection vulnerability. The script is a comprehensive post-exploitation toolkit that performs actions consistent with the stated vulnerability: it generates PHP payloads using phpfuck-style encoding to achieve remote code execution, and provides modules for reverse shells, webshells, persistence, credential dumping, and other offensive operations. All observed behavior is directed at the declared target (a vulnerable vBulletin instance) and is explicitly documented in the README. No concealed backdoor, deceptive payload, or unrelated operator-directed harm (e.g., credential theft from the PoC runner, unrelated remote access, or persistence on the analyst's machine) was found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarevBulletin
Attack typesRemote Code ExecutionEval Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, exploit.py, contains code that generates and delivers malicious payloads to achieve remote code execution, including reverse shells, webshells, and persistence mechanisms. This is clearly intended to exercise the vulnerability, not merely detect it.

exploit.py:111-115exploit.py:147-163exploit.py:173-187

Requirements

  • Target running vulnerable vBulletin (5.x through 5.7.5 or 6.x through 6.2.1)README.md:18
  • Network access to the target's AJAX endpointsexploit.py:84-103

Observed behavior

  • Generates PHPFuck-encoded payloads to bypass WAF filters and inject arbitrary PHP code via eval()exploit.py:81-109
  • Sends crafted POST requests to multiple vulnerable AJAX endpoints to achieve unauthenticated RCEexploit.py:562-583
  • Provides post-exploitation modules including reverse shell, webshell installation, persistence, credential dumping, and firewall disablingexploit.py:627-910
  • Includes a mass scanner for detecting vulnerable targets across multiple hostsexploit.py:1006-1158
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
PHPFuck-encoded eval injection payloads for vBulletin RCEThe script constructs payloads that exploit the described CVE-2026-61511 vulnerability to execute arbitrary PHP on the target server. This is the expected behavior of a PoC exploit for this CVE.exploit.py:81-109exploit.py:111-115
Post Exploitation Modules
Reverse shell, webshell, persistence, credential dump, firewall disable, etc.The script includes many post-exploitation features (reverse shell, webshell installation, cron/systemd persistence, credential dumping, firewall disabling, etc.). These are all directed at the target vBulletin server and are consistent with a weaponized exploit toolkit. They do not target the analyst's machine.exploit.py:627-633exploit.py:721-733exploit.py:744-751exploit.py:815-826exploit.py:828-835
Network Listener
Binds to 0.0.0.0 on user-specified port for reverse shellThe reverse shell listener binds to all interfaces on the attacker's machine, which is standard for receiving reverse shell connections. It does not establish any outbound connection to a third party.exploit.py:635-643
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the safecheck.py file, which is described in the README as a non-intrusive scanner. Only exploit.py and README.md are provided.
  • The analysis is based solely on static code review; the code was not executed, and its effectiveness is not verified.
  • The evidence envelope reports 7 total files in the repository; only 3 text files were included in the review. 4 files (including 1 non-text media file) were omitted. The omitted files are not described as containing executable code, but their content was not reviewed.
  • The analysis is based solely on static review of the provided text; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1