Nxploited/CVE-2026-47668

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-47668 in DbGate by injecting OS commands via the `functionName` or `variableName` parameters of JSON script `assign` commands sent to `POST /runners/start`. It includes an HTTP exfiltration listener and an optional reverse shell capability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python PoC exploit for CVE-2026-47668 (DbGate RCE) and its documentation. The code implements a legitimate security assessment tool: it authenticates to a target, probes for the vulnerability, and optionally executes a user-supplied command via the injection point, exfiltrating output to a user-controlled callback listener. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload was observed. The tool's behavior is fully explained by its stated purpose of authorized security testing.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareDbGate
Attack typesRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script that constructs and sends malicious payloads to the vulnerable endpoint to achieve remote code execution, including command execution, output exfiltration, and reverse shell capabilities. This goes beyond detection or scanning; it actively exploits the vulnerability.

CVE-2026-47668.py:1-6CVE-2026-47668.py:421-428CVE-2026-47668.py:855-879CVE-2026-47668.py:881-992

Requirements

  • Target running vulnerable DbGate version (≤ 7.1.8)README.md:3
  • Network access to the target's /runners/start endpointCVE-2026-47668.py:795-806

Observed behavior

  • Sends a JSON payload to POST /runners/start with a crafted functionName containing injected JavaScript that executes an OS command via child_process.execSync or execCVE-2026-47668.py:421-428CVE-2026-47668.py:466-495CVE-2026-47668.py:795-806
  • Starts an HTTP server to receive exfiltrated command output from the targetCVE-2026-47668.py:500-567CVE-2026-47668.py:569-595
  • Optionally starts a TCP listener to receive a reverse shell connection from the targetCVE-2026-47668.py:598-690
  • Automatically obtains a Bearer token by sending a login request to /auth/login if no token is providedCVE-2026-47668.py:770-793
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The tool sends a POST request to /auth/login to obtain a Bearer token, then sends a POST to /runners/start with a crafted JSON script to achieve code injection.This is the expected behavior for a PoC exploiting the described CVE-2026-47668 vulnerability.CVE-2026-47668.py:773-793CVE-2026-47668.py:795-816
Exfiltration Mechanism
The tool starts an HTTP listener to receive base64-encoded command output from the target.This is a standard technique for confirming command execution in a blind RCE scenario and is explicitly documented in the README.CVE-2026-47668.py:500-566README.md:170-212
Reverse Shell Capability
The tool can optionally generate a reverse shell payload and listen for a TCP connection.This is an optional feature for authorized testing, clearly documented and disabled by default. It is not a hidden backdoor.CVE-2026-47668.py:396-418README.md:244-283
Output Directory
The tool writes results to a local 'Nx/' directory.This is standard logging for a security tool and does not indicate any hidden data exfiltration from the operator's machine.CVE-2026-47668.py:30-38CVE-2026-47668.py:91-115
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the text evidence; its content is not provided.
  • The evidence does not include any execution output or confirmation that the exploit was successfully run against a live target.
  • One file in the repository (unclassified, 1505 bytes) was not provided as text and was not analyzed. Its metadata does not suggest it is executable or contains a payload.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1