BlankBire

GitHub · Repository owner · Source ID 165353658
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

BlankBire/CVE-2026-24136-Lab

Repository PoC1Created 2026-06-12ExploitCVE-2026-241368 files

57.2 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-24136, an IDOR vulnerability in Saleor's GraphQL API, by sending unauthenticated queries to retrieve personally identifiable information (PII) from orders.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a PoC script for CVE-2026-24136, an IDOR vulnerability in Saleor. The PoC script sends unauthenticated GraphQL queries to a local Saleor instance to demonstrate PII exfiltration. No backdoor, concealed operator-directed harm, or deceptive payload was observed. The script's behavior is consistent with its stated purpose of demonstrating the vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSaleor
Attack typesIDORInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary purpose is to exercise the vulnerability by sending unauthenticated requests to extract PII. It is described as a 'PoC khai thác' (exploit PoC) and its functions are named 'attack_single', 'attack_enumerate', and 'attack_from_file'. It does not merely check for the vulnerability's existence; it actively retrieves and displays sensitive data.

scripts/poc_cve_2026_24136.py:1-11scripts/poc_cve_2026_24136.py:196

Requirements

  • A running, vulnerable Saleor instance (versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44, or 3.22.0-a.0 through 3.22.28).README.md:10
  • Knowledge of a valid Saleor order ID, either as a sequential integer (for older versions) or a base64-encoded global ID (for versions using UUIDs).scripts/poc_cve_2026_24136.py:198-202

Observed behavior

  • Sends a GraphQL query to the Saleor API endpoint without any authentication headers.scripts/poc_cve_2026_24136.py:103-115
  • Extracts and displays PII such as email, full name, phone number, and address from the API response.scripts/poc_cve_2026_24136.py:134-194
  • Supports multiple attack modes: targeting a single order, enumerating a range of sequential order IDs, and reading order IDs from a file.scripts/poc_cve_2026_24136.py:196-304
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe PoC script sends POST requests to this endpoint to exploit the IDOR vulnerability. This is the expected target for the PoC and does not indicate a backdoor.scripts/poc_cve_2026_24136.py:24scripts/poc_cve_2026_24136.py:109-110
Data Exfiltration
Payload withheldThe PoC extracts and displays PII from order data, which is the intended demonstration of the CVE's impact. The data is only printed to the console or saved to a local file specified by the user.scripts/poc_cve_2026_24136.py:38-85scripts/poc_cve_2026_24136.py:134-194
Review boundaries

What the analysis did not establish

  • The evidence packet reports 'complete_artifact_coverage: false' and 'unclassified_bytes: 23919' from 6 files, indicating that not all files in the repository were provided for analysis. The analysis is based on the two provided text files: README.md and scripts/poc_cve_2026_24136.py.
  • Six files in the repository were not included in the text evidence; their content is unknown. The inventory lists them as binary or unclassified files, but their metadata was not analyzed for backdoor behavior.
  • The review is limited to static analysis of the provided text; the script was not executed, and no dynamic behavior was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.