murrez/cve-2026-48842Python checker for CVE-2026-48842, a pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin. Detects version, plugin path, and verifies SQLi via login probe.
Python 3 checker for CVE-2026-48842 in Roundcube Webmail (optional virtuser_query plugin).
This PoC is listed on PoCbit — CVE-2026-48842 on pocbit.org.
Running the PoC prints a PoCbit header; JSONL lines include pocbit / pocbit_page.
| Product | Roundcube Webmail |
| Component | Built-in plugin virtuser_query (DB user/email/host lookup) |
| Affected | 1.6.x < 1.6.16, 1.7.x < 1.7.1 (older 1.4/1.5 lines may also be affected if plugin enabled — patch per distro) |
| Fixed | 1.6.16, 1.7.1 |
| CVSS 3.1 | 8.1 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| CWE | CWE-89 |
| Auth | None (login / lookup path) |
When virtuser_query is configured ($config['virtuser_query'] in config.inc.php), usernames or emails are substituted into SQL templates via preg_replace('/%u/', $dbh->escape(...), ...). PHP interprets backslashes in the replacement string, undoing SQL escaping — pre-auth SQL injection (fix: use str_replace).
Advisory: Roundcube security updates 2026-05-24
pip install -r requirements.txt
# Detect Roundcube + version + virtuser plugin file
python poc.py -u https://webmail.example.com --json
# Active SQLi probe (SLEEP / error heuristics on login POST)
python poc.py -u https://webmail.example.com --verify
python poc.py --list targets.example.txt --threads 20 --quiet
python poc.py --list targets.example.txt --verify --sqli-delay 5
virtuser_query enabled on the server (not default on all installs). PoC flags plugin PHP path when reachable.--verify sends crafted _user values to ?_task=login (no valid password needed for injection attempt).virtuser_query from $config['plugins'].body="rcmail" && body="roundcube"
title="Roundcube Webmail"
Authorized testing only.