zeroc00I Exploits and Proofs of Concept

Showing 7 PoCs on this page

GitHub

zeroc00I/CVE-2026-63030

Repository PoC0Created 2026-07-18ScannerCVE-2026-630301 file

3.2 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Technical assessment

A Nuclei template that sends crafted HTTP requests to a WordPress instance to detect a time-based blind SQL injection vulnerability (CVE-2026-63030) via the REST API batch endpoint. It compares response times between a request with SLEEP(5) and a baseline SLEEP(0) request, and checks for specific HTTP status codes, but does not extract data or execute commands.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single Nuclei YAML template that sends crafted HTTP requests to detect a time-based SQL injection vulnerability (CVE-2026-63030) in WordPress. The template defines three requests (two with SLEEP(5) and one baseline with SLEEP(0)) and uses DSL matchers to compare response durations. No backdoor, deceptive payload, or concealed executable behavior is present. The template performs only the advertised vulnerability detection.

ClassificationScanner

Model confidence95%

AuthenticationNot required

Languagesyaml

Target softwareWordPress

Attack typesblind-sqlitime-based

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that sends HTTP requests to detect a vulnerability by observing time delays and response codes. It does not contain code to extract data, establish a shell, or otherwise exploit the vulnerability for impact beyond detection. This is consistent with a scanner.

nuclei-CVE-2026-63030.yaml:1-106

Requirements

Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API enabled.nuclei-CVE-2026-63030.yaml:8-9

Observed behavior

Sends a POST request to /wp-json/batch/v1 with a nested batch payload containing a SQL injection payload (SLEEP(5)) in the author_exclude parameter.nuclei-CVE-2026-63030.yaml:25-45
Sends a second POST request with a baseline payload (SLEEP(0)) to establish a reference response time.nuclei-CVE-2026-63030.yaml:48-69
Sends a third request as a fallback using the ?rest_route parameter.nuclei-CVE-2026-63030.yaml:72-93
Uses DSL matchers to check if the response time difference between the first and second request is at least 3.5 seconds, the first request duration is at least 5 seconds, and both responses have a status code of 207 or 200.nuclei-CVE-2026-63030.yaml:95-102

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Detection Template: Payload withheldThe artifact is a Nuclei template designed to detect CVE-2026-63030 via time-based SQL injection. It sends HTTP requests with SLEEP(5) and SLEEP(0) payloads and compares response durations.nuclei-CVE-2026-63030.yaml:1-106
External Reference: Payload withheldReference to an external proof-of-concept repository. The template itself does not fetch or execute content from this URL.nuclei-CVE-2026-63030.yaml:11

Review boundaries

What the analysis did not establish

material evidence limitation
Only the single YAML file was reviewed; no other files from the repository were included.
The template references an external URL (payload withheld) in metadata, but the template does not execute or fetch content from it.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub