MettHK/CVE-2023-48084-Revised

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2023-48084, a time-based blind SQL injection vulnerability in Nagios XI, to extract database schemas, tables, columns, and data. It uses binary search and multithreading for efficient data exfiltration.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2023-48084.py), a README.md, and a requirements.txt file. The script implements a time-based blind SQL injection exploit against Nagios XI for CVE-2023-48084. It uses binary search and multithreading to extract database schema, tables, columns, and data. No backdoor, trojan, or deceptive behavior was observed. The script performs only the advertised SQL injection and data extraction; it does not establish persistence, exfiltrate data to an unrelated third party, download or execute secondary payloads, or conceal any hidden functionality.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareNagios XI
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits a SQL injection vulnerability to extract data from a target database. It constructs malicious SQL payloads, sends them to the vulnerable endpoint, and interprets the time-based responses to exfiltrate information. This is the definition of an exploit.

CVE-2023-48084.py:1-373README.md:1-90

Requirements

  • Requires a valid Nagios XI session cookie or API token for authentication.CVE-2023-48084.py:266-296
  • Target must be running a vulnerable version of Nagios XI (before 5.11.3).README.md:16

Observed behavior

  • Sends HTTP GET requests to the vulnerable endpoint '/admin/banner_message-ajaxhelper.php' with a time-based SQL injection payload in the 'id' parameter.CVE-2023-48084.py:52CVE-2023-48084.py:117-121
  • Uses a binary search algorithm to determine the length of SQL query results and the ASCII value of each character, minimizing the number of requests.CVE-2023-48084.py:109-130CVE-2023-48084.py:133-150
  • Employs multithreading to extract multiple characters in parallel, speeding up the data exfiltration process.CVE-2023-48084.py:153-186
  • Provides an interactive menu to discover and select database schemas, tables, and columns, or allows direct specification via command-line arguments.CVE-2023-48084.py:216-251
  • Dumps the selected data from the database and displays it to the user.CVE-2023-48084.py:210-213CVE-2023-48084.py:254-258
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Time-based blind SQL injection via /admin/banner_message-ajaxhelper.phpThe script sends crafted HTTP GET requests with SLEEP() payloads to extract database information. This is the normal and expected behavior for a PoC targeting CVE-2023-48084.CVE-2023-48084.py:52CVE-2023-48084.py:87-99CVE-2023-48084.py:109-130CVE-2023-48084.py:133-150
Data Extraction
Extracts database schemas, tables, columns, and row data using group_concatThe script provides functions to enumerate and dump database contents, which is the core purpose of the PoC. No data is sent anywhere other than the target server.CVE-2023-48084.py:189-213
Network Communication
HTTP requests to the user-supplied target URL onlyAll network requests are directed to the base URL provided by the user via the -u argument. There are no hardcoded external URLs, callbacks, or data exfiltration endpoints.CVE-2023-48084.py:102-106CVE-2023-48084.py:265
Dependency
requests and optional pwntoolsThe script imports only standard library modules and the well-known requests library. pwntools is optional and used only for progress display. No obfuscated or suspicious imports are present.CVE-2023-48084.py:12-20requirements.txt:1-2
Review boundaries

What the analysis did not establish

  • The evidence includes a complete, readable Python script and documentation, but one file (likely a license or .gitignore) was omitted from the text content. This does not affect the classification.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness or safety is not verified.
  • One file in the repository (unclassified, 214 bytes) was not provided as text and was flagged as metadata-only. Its content is unknown, but it is not the main exploit script and is unlikely to contain backdoor behavior given the artifact's nature.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1