MoxitPanchal

GitHub · Repository owner · Source ID 128708440
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

MoxitPanchal/EverShop-Lab-CVE-2026-25993

Repository PoC1Created 2026-07-09WriteupCVE-2026-259935 files

11.6 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a lab environment setup and a technical writeup describing CVE-2026-25993, a second-order SQL injection in EverShop. It provides Docker configuration, a README with vulnerability analysis and exploitation goals, and seed scripts, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Docker-based lab environment for CVE-2026-25993, a second-order SQL injection in EverShop. All reviewed files (Dockerfile, README.md, entrypoint.sh, seed.js) serve the stated educational purpose: deploying a vulnerable EverShop v2.1.0 instance, seeding demo data, and providing instructions for exploiting the vulnerability. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesDockerfileMarkdownShellJavaScript
Target softwareEverShop
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it provides a technical description of the vulnerability, setup instructions for a lab environment, and exploitation goals, but does not include any code that exploits or scans for the vulnerability. The Dockerfile, entrypoint.sh, and seed.js are for environment setup, not for exercising the vulnerability.

README.md:42-60Dockerfile:1-23entrypoint.sh:1-89seed.js:1-118

Requirements

  • Docker Engine 24+ with Docker Compose v2+ and 2 GB free RAM are required to deploy the lab environment.README.md:5-6

Observed behavior

  • The README describes the vulnerability as a second-order SQL injection in category URL rewrite processing, where the url_key field allows SQL metacharacters, and an event subscriber builds raw SQL via string concatenation.README.md:44
  • The README sets a goal to dump the entire database by extracting the PostgreSQL version, enumerating tables, and extracting row data.README.md:50-54
  • The entrypoint script sets up the EverShop application, creates an admin user, and seeds base data using seed.js.entrypoint.sh:63-75
  • The seed.js script populates the database with categories, products, a collection, and a widget for the lab environment.seed.js:19-106
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Software Deployment
Payload withheldThe Dockerfile (line 9) clones the vulnerable version of EverShop, which is the target of the CVE. This is expected for a PoC lab.Dockerfile:9
Database Seeding
Payload withheldThe seed script (lines 19-106) populates the database with demo data, which is necessary for a functional lab environment. No malicious data is inserted.seed.js:19-106
Admin User Creation
Payload withheldThe entrypoint script (lines 64-69) creates an admin user for the lab. The credentials are publicly documented in the README (lines 23-24) and are standard for a local test environment.entrypoint.sh:64-69README.md:23-24
Review boundaries

What the analysis did not establish

  • One file (docker-compose.yml) is omitted from the evidence, which may contain additional configuration details.
  • The evidence does not include the vulnerable application source code, only the lab setup and description.
  • One file (docker-compose.yml) was flagged as metadata-only and not analyzed; its content could contain additional configuration, but the reviewed files provide a complete and consistent picture of the lab's behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.