Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-113365. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit targets webSPELL <= 4.01.02, leveraging a file upload vulnerability and blind SQL injection to achieve remote code execution. It requires register_globals=On and exploits improper file upload handling and SQL injection in the members.php file.
Description
webSPELL 4.01.02 - PHP Remote Code Execution
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by DarkFig · phpwebappsphp
https://www.exploit-db.com/exploits/3402
This exploit targets webSPELL <= 4.01.02, leveraging a file upload vulnerability and blind SQL injection to achieve remote code execution. It requires register_globals=On and exploits improper file upload handling and SQL injection in the members.php file.
Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target:
webSPELL <= 4.01.02
Auth required
Prerequisites:
register_globals=On · file upload access · SQL injection vulnerability
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026