tc4dy/CVE-2026-14762-PoC-Exploit

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based time-based blind SQL injection exploit targeting CVE-2026-14762 in code-projects Hotel and Tourism Reservation 1.0. The primary artifact (exploit.py) implements binary-search character extraction to dump databases, read files via LOAD_FILE, and write a PHP webshell via INTO OUTFILE for remote code execution. A secondary script (basic_exploit.py) provides a simple vulnerability check.

Backdoor review

No backdoor observed in reviewed code

The supplied text files (README.MD, basic_exploit.py, exploit.py, requirements.txt) implement a time-based blind SQL injection exploit for CVE-2026-14762. All code is consistent with the stated purpose: sending crafted HTTP requests to a vulnerable /admin/rooms.php endpoint, measuring response delays to infer database content, and offering optional file read/write and interactive SQL shell features. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential theft, or deceptive payloads were observed. The exploit operates only against a user-supplied target and does not perform any hidden actions against the operator.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwarecode-projects Hotel and Tourism Reservation
Attack typessql injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary file exploit.py contains complete code to exploit the SQL injection vulnerability, including database exfiltration, file read, and webshell write for remote code execution. The README explicitly describes it as an exploit achieving RCE. The basic_exploit.py is a simple vulnerability scanner, but the dominant artifact is the full exploit.

exploit.py:1-446README.MD:8-10basic_exploit.py:1-28

Requirements

  • Target running code-projects Hotel and Tourism Reservation 1.0 with accessible /admin/rooms.php endpointexploit.py:58README.MD:9
  • MySQL database with SLEEP() function available and vulnerable to time-based blind SQL injectionexploit.py:134README.MD:96

Observed behavior

  • Sends HTTP GET requests to /admin/rooms.php with a crafted delete parameter containing a time-based blind SQL injection payloadexploit.py:133-136basic_exploit.py:12-13
  • Uses binary search over ASCII range to extract string values from database responses by measuring SLEEP() delaysexploit.py:154-180
  • Enumerates database name, tables, and columns via information_schema queriesexploit.py:182-217
  • Dumps table data row by row and column by column using time-based extractionexploit.py:219-240
  • Reads server files using LOAD_FILE() SQL functionexploit.py:242-250
  • Writes a PHP webshell to the webroot using SELECT ... INTO OUTFILE for remote code executionexploit.py:252-267
  • Provides an interactive SQL shell for manual time-based query executionexploit.py:269-285
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Time-based blind SQL injection via GET /admin/rooms.php?delete=<payload>The core exploit logic uses conditional SLEEP() injection to extract data character by character, matching the CVE description.exploit.py:133-142exploit.py:154-180
File Write Capability
PHP webshell deployment via INTO OUTFILEThe write_webshell method writes a PHP one-liner to the target server's webroot. This is a documented feature of the exploit, not a hidden backdoor against the operator.exploit.py:252-267
Network Communication
HTTP requests to user-supplied target onlyAll network requests are directed to the target URL provided by the operator. No hardcoded external callbacks, C2 servers, or data exfiltration to third parties are present.exploit.py:102-131basic_exploit.py:11-20
Review boundaries

What the analysis did not establish

  • Evidence includes only selected text files; one non-text media file (cve_exploit.png) and two text files without content are not provided, but the core exploit code is complete.
  • The artifact is not executed; classification is based on static analysis of the provided source code and documentation.
  • Three files from the repository snapshot were not included in the text evidence: one non-text media file (cve_exploit.png, 396649 bytes) and two unclassified files (1755 bytes total). Their content was not reviewed. The inventory metadata does not suggest they contain executable code, but their absence is a material limitation.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1