XploitGh0st/CVE-2025-26794-exploit

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit tool for CVE-2025-26794 that performs time-based blind SQL injection against Exim 4.98 via the ETRN command. It extracts database tables, columns, and data using binary search, and includes an interactive SQL query mode.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2025-26794, an SQL injection vulnerability in Exim 4.98. The Python script (exploit.py) implements time-based blind SQL injection against a remote SMTP server using the ETRN command. All code is consistent with the stated purpose of authorized penetration testing and data extraction. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The script uses only standard library modules and performs no network activity beyond connecting to the user-supplied target.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareExim
Attack typesSQL InjectionTime-based Blind SQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains functional Python code that actively exploits CVE-2025-26794 by sending malicious SQL injection payloads to extract data from a target Exim server. It is not limited to detection or scanning; it performs data extraction and includes an interactive query mode.

exploit.py:88-91exploit.py:110-149exploit.py:239-264

Requirements

  • Target must be running Exim 4.98 with SQLite DBM storage and ETRN serialization enabled.README.md:24-27
  • Network access to the target SMTP service (default port 25).README.md:38-39

Observed behavior

  • Establishes an SMTP connection and sends a normal ETRN command to measure baseline response time.exploit.py:81-83
  • Sends a crafted ETRN command containing a time-delay SQL injection payload to confirm vulnerability.exploit.py:88-91
  • Extracts database table names by querying sqlite_master via time-based blind SQL injection.exploit.py:184-188
  • Extracts column names using pragma_table_info and extracts data from tables using binary search over ASCII values.exploit.py:206-209exploit.py:110-149
  • Provides an interactive mode for executing arbitrary SQLite queries and extracting results.exploit.py:239-264
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
socket.connect((self.host, self.port))The script connects to a user-supplied SMTP target to deliver SQL injection payloads, consistent with the stated exploit behavior.exploit.py:53
Sql Injection Payload
ETRN #',1); SELECT 1 FROM tbl WHERE 1234=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) /*The core exploit payload uses a time-delay technique to perform blind SQL injection, matching the described vulnerability.exploit.py:89exploit.py:46
Authorization Prompt
Do you have explicit authorization? (yes/no):The script includes a runtime authorization check before proceeding, reinforcing the stated educational and authorized-testing purpose.exploit.py:365-368
Review boundaries

What the analysis did not establish

  • Evidence does not include execution output or verification that the exploit works against a live target.
  • The artifact's README.md contains a badge stating 'Status: PoC' but the code implements full data extraction, not just proof of concept.
  • No binary files were present in the repository; the review covers only the three text files (README.md, exploit.py, requirements.txt).
  • The review does not assess whether the exploit is functional or effective against a real target.
  • The artifact's author identity (XploitGh0st) and repository name are noted but not treated as evidence of backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1