CVE-2021-44026

This repository contains a functional exploit for CVE-2021-44026, a SQL injection vulnerability in Roundcube. The exploit leverages CVE-2020-35730 (XSS) to deliver a payload that exfiltrates session data and emails via a Flask-based C2 server.

This PoC demonstrates a chained exploit combining XSS and SQLi in Roundcube Webmail to exfiltrate session data. The Python script sends a malicious email with an XSS payload that triggers a SQL injection to extract session variables.