ydking0911

GitHub · Repository owner · Source ID 91651719
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

ydking0911/CVE-2026-4060-PoC

Repository PoC0Created 2026-05-14ScannerCVE-2026-40609 files

1.6 MiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Nuclei detection template and supporting documentation for CVE-2026-4060. It checks for the presence of a vulnerable Geo Mashup plugin version and then sends a time-based SQL injection payload to confirm the vulnerability via response delay, without extracting data.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documentation file and a Nuclei detection template (CVE-2026-4060.yaml). The README describes a legitimate SQL injection proof-of-concept for CVE-2026-4060, including setup instructions, test results, and mitigation. The Nuclei template contains standard detection logic with no concealed or deceptive behavior. No backdoor, trojan, or suspicious payload is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAMLMarkdown
Target softwareGeo Mashup WordPress Plugin
Attack typesSQL Injection (Time-Based Blind)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (nuclei/CVE-2026-4060.yaml) that detects the vulnerability by checking the plugin version and confirming a time delay from a SLEEP injection. It does not extract data or exploit the vulnerability beyond confirming its presence. The README.md describes a separate Python PoC (poc.py) for data extraction, but that file is not included in the supplied evidence.

nuclei/CVE-2026-4060.yaml:1-70README.md:119-130

Requirements

  • Target must have Geo Mashup plugin version <= 1.13.18 installed and active.nuclei/CVE-2026-4060.yaml:47-52
  • The target's render-map endpoint must be accessible and return a response containing 'GeoMashup.createMap'.nuclei/CVE-2026-4060.yaml:64-69

Observed behavior

  • Sends an HTTP GET request to /wp-content/plugins/geo-mashup/readme.txt to extract the plugin's stable version and checks if it is <= 1.13.18.nuclei/CVE-2026-4060.yaml:34-54
  • If the version check passes, sends a second HTTP GET request to the render-map endpoint with a SLEEP(8) SQL injection payload in the sort parameter.nuclei/CVE-2026-4060.yaml:56-63
  • Matches the response if the status code is 200, the body contains 'GeoMashup.createMap', and the request duration is >= 8 seconds, indicating a successful time-based SQL injection.nuclei/CVE-2026-4060.yaml:64-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldExample SQL injection payload targeting a local test environment, consistent with the described vulnerability.README.md:114
Url
Payload withheldNuclei template payload targeting the same local test endpoint for vulnerability detection.nuclei/CVE-2026-4060.yaml:59
Review boundaries

What the analysis did not establish

  • The Python PoC script (poc.py) referenced in README.md for data extraction is not included in the supplied evidence. Only the Nuclei scanner template and README documentation are provided.
  • The evidence packet reports complete_artifact_coverage is false, indicating not all files from the repository are included.
  • Binary files (e.g., screenshots) are flagged as metadata only and were not analyzed.
  • Only two text files (README.md and nuclei/CVE-2026-4060.yaml) were reviewed. Seven other files (including 4 non-text media files and 3 unclassified files) were omitted from the evidence packet and not analyzed. The complete artifact coverage is false, so backdoor behavior in unexamined files cannot be ruled out.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.