SowatKheang

GitHub · Repository owner · Source ID 42835035
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

SowatKheang/CVE_2026_2576_PoC

Repository PoC2Created 2026-03-26ExploitCVE-2026-257610 files

Python · 642.6 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a fully functional time-based blind SQL injection exploit targeting CVE-2026-2576 in the Business Directory Plugin for WordPress. It includes a Python script (poc.py) that sends crafted HTTP requests to extract database contents character by character using binary search and parallel threading.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept for CVE-2026-2576, a time-based blind SQL injection in the Business Directory Plugin for WordPress. All supplied text files (README, Docker Compose, SQL seed, Python PoC scripts, and shell setup) describe and implement the claimed vulnerability exploitation against a local lab environment. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed. The PoC performs only the advertised SQL injection extraction.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonShellSQLPHP
Target softwareBusiness Directory Plugin – Easy Listing Directories for WordPress
Attack typesSQL InjectionTime-Based Blind SQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is the Python script 'poc.py', which actively exploits the SQL injection vulnerability by sending malicious HTTP requests to extract data from the target database. This is confirmed by the script's core functions: 'oracle' sends time-based payloads, 'extract_char' performs binary search extraction, and 'cmd_dump' exfiltrates entire table rows. The README explicitly labels it a 'PoC' and provides commands to 'detect' and 'extract' data.

cve-2026-2576-lab/poc/poc.py:1-5cve-2026-2576-lab/poc/poc.py:82-89cve-2026-2576-lab/poc/poc.py:96-112cve-2026-2576-lab/poc/poc.py:234-263README.md:1

Requirements

  • A target running a vulnerable version (<= 6.4.21) of the Business Directory Plugin with a valid payment_key.README.md:29cve-2026-2576-lab/poc/poc.py:279-281

Observed behavior

  • Sends HTTP GET requests to the vulnerable checkout endpoint with a crafted 'payment[]' parameter containing a time-based SQL injection payload.cve-2026-2576-lab/poc/poc.py:61-66cve-2026-2576-lab/poc/poc.py:82-89
  • Uses a binary search algorithm on ASCII values to extract characters from database query results one by one.cve-2026-2576-lab/poc/poc.py:96-112
  • Employs multi-threading to extract multiple character positions in parallel, speeding up data exfiltration.cve-2026-2576-lab/poc/poc.py:151-154
  • Provides commands to detect the vulnerability, extract database metadata, list tables, dump table contents, and run custom SQL queries.cve-2026-2576-lab/poc/poc.py:289-293
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit
Payload withheldThe PoC exploits CVE-2026-2576 to extract database contents using SLEEP-based timing oracles.cve-2026-2576-lab/poc/poc.py:82-89README.md:120-130
Lab Environment
Payload withheldThe repository provides a fully containerized lab for safe, isolated testing of the SQL injection.cve-2026-2576-lab/docker-compose.yml:1-113cve-2026-2576-lab/setup.sh:1-137
Test Data
Payload withheldThe init-db.sql creates a dummy secrets table to demonstrate data extraction, not to exfiltrate real credentials.cve-2026-2576-lab/init-db.sql:13-23
Review boundaries

What the analysis did not establish

  • Two non-text media files (images) totaling 613,861 bytes were not analyzed; they are referenced in the README as screenshots of expected output and are unlikely to alter the classification.
  • The evidence packet reports 'complete_artifact_coverage: false' because the full repository snapshot exceeded the single-packet budget, but all 6 selected text files are provided in their entirety.
  • Two non-text media files (images referenced in README) and two unclassified files were not analyzed; their content is unknown.
  • Two text files (likely .gitignore and uploads.ini) were omitted from the packet and not reviewed.
  • The review is limited to static analysis of the supplied text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.