cPanel & WHM SQL Injection via Database Rename Privilege Escalation to MySQL Root

#!/usr/bin/env bash
# check_cve_2026_58048.sh — CVE-2026-58048 cPanel SQL Injection Checker
# Run as root on the target cPanel/WHM server.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Must run as root" >&2
  exit 2
fi

VERSION_FILE="/usr/local/cpanel/version"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — cPanel not detected on this host (no $VERSION_FILE)"
  exit 2
fi

INSTALLED=$(cat "$VERSION_FILE" | tr -d '[:space:]')
echo "Detected cPanel version: $INSTALLED"

# Parse major.minor.patch from installed version
IFS='.' read -r MAJOR MINOR PATCH <<< "$INSTALLED"

# Patched versions per branch:
# 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32
# WP Squared: 138.1.6

check_patched() {
  local branch_minor="$1"
  local branch_sub="$2"
  local patch_level="$3"
  local fixed_patch="$4"

  if [[ "$MINOR" == "$branch_minor" ]] && [[ "$PATCH" == "$branch_sub" ]]; then
    # Compare the build number (4th segment)
    local build
    build=$(echo "$INSTALLED" | awk -F'.' '{print $4}')
    if [[ -z "$build" ]]; then
      build=0
    fi
    if [[ "$build" -ge "$fixed_patch" ]]; then
      return 0  # patched
    else
      return 1  # vulnerable
    fi
  fi
  return 2  # not this branch
}

RESULT="UNKNOWN"

# Check each branch
for branch_info in "110:0:137" "118:0:71" "126:0:78" "134:0:48" "136:0:32"; do
  IFS=':' read -r bminor bsub bfix <<< "$branch_info"
  if [[ "$MINOR" == "$bminor" ]]; then
    build=$(echo "$INSTALLED" | awk -F'.' '{print $4}')
    [[ -z "$build" ]] && build=0
    if [[ "$build" -ge "$bfix" ]]; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    break
  fi
done

# Check if version is newer than all affected branches (138+)
if [[ "$RESULT" == "UNKNOWN" ]] && [[ "$MINOR" -gt 136 ]]; then
  # WP Squared / newer — check if >= 138.1.6
  build=$(echo "$INSTALLED" | awk -F'.' '{print $4}')
  [[ -z "$build" ]] && build=0
  if [[ "$MINOR" -gt 138 ]]; then
    RESULT="PATCHED"
  elif [[ "$MINOR" -eq 138 ]] && [[ "${PATCH:-0}" -ge 1 ]] && [[ "$build" -ge 6 ]]; then
    RESULT="PATCHED"
  else
    RESULT="VULNERABLE"
  fi
fi

# Also check if MySQL feature is disabled (mitigated)
MYSQL_DISABLED=false
if command -v whmapi1 &>/dev/null; then
  # Check default feature list for MySQL
  FEAT=$(whmapi1 getfeaturelist featurelist=default 2>/dev/null | grep -i 'mysql' || true)
  if echo "$FEAT" | grep -qi '0'; then
    MYSQL_DISABLED=true
  fi
fi

echo "========================================"
echo "CVE-2026-58048 Assessment: $RESULT"
if [[ "$MYSQL_DISABLED" == true ]]; then
  echo "NOTE: MySQL feature appears disabled in default feature list (mitigated)"
fi
echo "========================================"

case "$RESULT" in
  VULNERABLE) exit 1 ;;
  PATCHED)    exit 0 ;;
  *)          exit 2 ;;
esac