OscarBataille/CVE-2025-26794

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker_lab

Created Vuln labCVE-2025-26794Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based lab that builds Exim 4.98 from source with SQLite DBM support and a custom runtime configuration, intended to demonstrate CVE-2025-26794, a blind SQL injection in Exim's SQLite hints database.

docker_lab/Dockerfile:1-36README.md:1-127

Lab assessment

Vulnerability lab

The README explicitly states the repository is for CVE-2025-26794, describes the vulnerability, and provides a local Docker lab to reproduce it. The Dockerfile builds Exim with SQLite support and copies a configuration that enables the ETRN command, matching the vulnerability requirements.

README.md:1-3README.md:85-90docker_lab/Dockerfile:20-22
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Exim 4.98 build

vulnerable target

Exim 4.98 is cloned from GitHub, compiled with SQLite DBM support (USE_SQLITE=yes) and debug flags, and installed. The build is configured to run as user exim-demo.

docker_lab/Dockerfile:7-26

Exim runtime configuration

enables ETRN commandenables SQLite DBM

A custom Exim configuration file is copied into the container. It defines an ACL for the ETRN command (acl_smtp_etrn) that accepts all ETRN requests, which is required for the SQL injection exploit.

docker_lab/Dockerfile:32docker_lab/configure:310-312

start-exim.sh

starts Exim daemon with debug output

A shell script that starts the Exim daemon in debug mode (-d) listening on port 25 and processing the queue every 30 minutes. It also contains a commented-out gdb command and a commented-out Exim expansion test.

docker_lab/start-exim.sh:1-3

test.py

remote vulnerability test script

A Python script that connects to an Exim server on port 25, sends a benign ETRN command, then sends a time-based blind SQL injection payload via ETRN, and measures the response time to determine if the target is vulnerable.

docker_lab/test.py:1-60

docker.sh

builds and runs the Docker lab

A shell script that builds the Docker image, removes any existing container, runs a new container with SYS_PTRACE capability, seccomp unconfined, port 25 published, and then opens an interactive bash shell inside the container.

docker_lab/docker.sh:1-4

connect_docker.sh

connects to the running container

A shell script that executes an interactive bash shell in the running 'exim' container.

docker_lab/connect_docker.sh:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-26794

Supported by supplied evidence

The README describes a blind SQL injection in Exim 4.98 when SQLite is used as the DBM and the ETRN command is enabled. The Dockerfile builds Exim 4.98 with USE_SQLITE=yes, and the provided configure file enables the ETRN ACL. The start-exim.sh script starts Exim with debug output, and test.py demonstrates a time-based blind SQL injection payload via the ETRN command. All visible evidence aligns with the CVE description.

README.md:1-3docker_lab/Dockerfile:20-22docker_lab/configure:310-312docker_lab/test.py:30-45
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Exim must be compiled with SQLite DBM support (USE_SQLITE=yes).docker_lab/Dockerfile:20-22
  • The ETRN command must be enabled in the Exim configuration (acl_smtp_etrn must be defined).docker_lab/configure:310-312
  • The attacker must be able to connect to the Exim SMTP port (25) and issue ETRN commands.docker_lab/docker.sh:3

Evidence-described exercise path

  1. Build the Docker image and start the container using docker.sh.docker_lab/docker.sh:1-4
  2. Inside the container, start the Exim daemon with start-exim.sh.docker_lab/start-exim.sh:1
  3. Connect to the Exim server on port 25 using netcat or test.py.README.md:93-95
  4. Issue a crafted ETRN command containing a SQL injection payload to trigger the vulnerability.README.md:96-98
  5. Observe the Exim debug log for SQLite syntax errors or use test.py to measure time-based blind SQL injection response.README.md:98docker_lab/test.py:30-45
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target (Exim 4.98 with SQLite). The Dockerfile builds and runs Exim locally, the test script connects to localhost:25, and the start script only launches the Exim daemon. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

docker_lab/Dockerfile:1-36docker_lab/docker.sh:1-4docker_lab/test.py:1-60
Review boundaries

What the analysis did not establish

  • The packet does not include the Makefile-Linux file referenced in the Dockerfile (docker_lab/Makefile-Linux), so the exact build flags cannot be fully verified.
  • The Dockerfile uses 'cpan install File::FcntlLock' which may fail or require network access; the lab's build reproducibility is not guaranteed.
  • The start-exim.sh script contains a commented-out gdb command and a commented-out Exim expansion test; their purpose is not explained but they are not executed.
  • The test.py script sends a time-based payload that could cause high CPU load on the target, but this is expected for a blind SQL injection proof-of-concept.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1