tc4dy/CVE-2026-58048-PoC-Exploit

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full weaponized exploit toolkit for CVE-2026-58048, a critical SQL injection vulnerability in cPanel. The primary file, exploit.py, contains code to authenticate to cPanel, manipulate SQL modes, inject arbitrary SQL via the database rename functionality, and execute post-exploitation actions including reverse shells, file read/write, UDF command execution, and user creation. A secondary scanner script (safecheck.py) is described in the README but not included in the supplied evidence.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, an exploit script (exploit.py), and a requirements file for CVE-2026-58048. The exploit script implements the documented SQL injection attack against cPanel and provides post-exploitation actions (reverse shell, persistence, file read/write, etc.) that are consistent with the stated purpose of a weaponized PoC for authorized testing. No concealed, unrelated, or operator-directed harmful behavior beyond the advertised exploit was observed in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwarecPanel & WHM
Attack typesSQL InjectionRemote Code ExecutionPrivilege EscalationPersistence
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit.py contains complete, functional code that actively exploits CVE-2026-58048 by injecting malicious SQL via the database rename functionality to gain root-level MySQL access and perform post-exploitation actions such as reverse shells, file I/O, and user creation. This goes beyond detection or scanning; it is a weaponized exploit toolkit.

exploit.py:296-314exploit.py:329-355exploit.py:449-453

Requirements

  • Valid cPanel account credentials (username/password) on the target server.README.md:21exploit.py:471-481
  • Target cPanel server must be running a vulnerable version (11.x before 11.138.1.6).README.md:17exploit.py:185-188
  • MySQL port (default 3306) must be reachable from the attacker's machine.exploit.py:223-225

Observed behavior

  • Authenticates to cPanel using provided credentials via UAPI endpoint /execute/Version/get_version.exploit.py:259-275
  • Connects directly to the MySQL server and sets the session SQL mode to ANSI_QUOTES to enable injection.exploit.py:276-285
  • Creates a temporary database, then renames it with a payload containing injected SQL (e.g., GRANT ALL PRIVILEGES) via the vulnerable /execute/Mysql/rename_database endpoint.exploit.py:286-314
  • Executes post-exploitation actions: creates admin MySQL users, reads/writes server files via LOAD_FILE/INTO OUTFILE, executes OS commands via UDF, changes root password, and creates new cPanel users for persistence.exploit.py:329-355
  • Provides an interactive shell for ongoing SQL execution, file operations, and user management.exploit.py:386-448
  • Supports mass scanning of multiple targets from a file using multi-threading.exploit.py:595-643
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
exploit.py implements SQL injection via cPanel database rename, with post-exploitation features including reverse shell, UDF command execution, file read/write, and user creation.All observed behavior is consistent with the advertised CVE-2026-58048 exploit toolkit and does not indicate a backdoor or deceptive payload.exploit.py:1-692
Review boundaries

What the analysis did not establish

  • The safecheck.py scanner script is described in the README but its source code is not included in the supplied evidence packets.
  • The evidence includes only three text files (README.md, exploit.py, requirements.txt); four other files (including one non-text media file) are omitted.
  • The analysis is based solely on static code review; the code was not executed, and its actual effectiveness or reliability is not verified.
  • One binary file (58048.png) was flagged as metadata-only and not analyzed; it could contain hidden content.
  • Three text files (total 22,095 bytes) were present in the repository but not included in the selected text evidence; their content is unknown.
  • The review is limited to static analysis of the provided text; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1