0xBlackash/CVE-2026-46817

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that probes a target URL for known Oracle Payments endpoints and reports whether the target is likely vulnerable to CVE-2026-46817. It does not contain any exploit payload or code to exercise the vulnerability; it only performs HTTP GET requests and checks response status codes and body content for indicators of the affected software.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python script and a README for a CVE-2026-46817 vulnerability checker. The script performs only non-invasive HTTP GET requests to probe for Oracle Payments endpoints and reports findings. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareOracle E-Business SuiteOracle Payments
Attack typesvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script only performs HTTP GET requests to check for the presence of Oracle Payments endpoints and inspects response metadata to infer vulnerability. It does not send any payload, attempt to trigger the vulnerability, or execute any action beyond detection. The script's own docstring and output messages confirm it is a 'Safe Checker' that performs no exploitation.

CVE-2026-46817.py:3CVE-2026-46817.py:5CVE-2026-46817.py:74

Requirements

  • Network access to the target Oracle E-Business Suite instance via HTTP.CVE-2026-46817.py:40

Observed behavior

  • Sends HTTP GET requests to a list of hardcoded Oracle Payments endpoints on the target.CVE-2026-46817.py:23-40
  • Checks if the HTTP response status code is 200, 302, or 403 and prints a warning if so.CVE-2026-46817.py:44-46
  • Checks the response body for strings indicating Oracle E-Business Suite 12.2.x.CVE-2026-46817.py:49-50
  • Prints a risk assessment message if any endpoint is found, stating the target is likely vulnerable.CVE-2026-46817.py:67-70
  • Explicitly states that no exploitation is performed.CVE-2026-46817.py:74
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
HTTP GET requests to target-supplied URL with paths like /ibytransmit, /OA_HTML/IbyTransmitThe script probes for Oracle Payments endpoints to assess exposure to CVE-2026-46817. This is expected behavior for a vulnerability checker.CVE-2026-46817.py:23-30CVE-2026-46817.py:40
Author Identity
Ashraf Zaryouh (@0xBlackash)Author attribution in script and README. No evidence this identity is used for deception.CVE-2026-46817.py:4README.md:1
Review boundaries

What the analysis did not establish

  • The evidence does not include any exploit code or demonstration of the vulnerability being triggered; only a scanner is present.
  • The README.md file contains only documentation and screenshots, not executable code.
  • Only the two text files (CVE-2026-46817.py and README.md) were reviewed. No binary files were present in the evidence.
  • The review does not verify the correctness or safety of the vulnerability check against a live target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1