Dockerfile
container image definition
Defines an Ubuntu 22.04 image with OpenJDK 17, Maven, MariaDB server, copies the application source and start script, builds the app with Maven, exposes port 8080, and runs start.sh.
Dockerfile:1-25EQSTLab/CVE-2026-0603
PoC files
15 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a fully functional web application that demonstrates a second-order SQL injection vulnerability (CVE-2026-0603) in Hibernate ORM. It provides a Dockerized environment and step-by-step instructions to register a user with a malicious username containing an SQL payload, then trigger a bulk update or delete operation that affects all records in the database, not just the attacker's own.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept (PoC) for CVE-2026-0603, a second-order SQL injection in Hibernate ORM. All reviewed source files (Java entities, DTOs, a Spring Boot application, a shell startup script, and a frontend HTML page) implement a simple user management demo with no concealed executable behavior, no persistence mechanisms beyond the demo's own database, and no unrelated remote access or credential theft. The README describes the vulnerability and provides reproduction steps. No backdoor or trojan behavior is observed.
ClassificationExploit
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact includes a complete, runnable application and explicit instructions to perform actions that result in unauthorized mass data modification or deletion. This constitutes exploit code because it is designed to exercise the vulnerability and cause a harmful outcome (mass deletion/modification) beyond mere detection.
README.md:3README.md:38-53Requirements
- A running instance of the vulnerable application, which can be started via the provided Docker commands.
README.md:31-34 - The application must be configured to use InlineIdsOrClauseBulkIdStrategy, as indicated in the mitigation section.
README.md:58-59
Observed behavior
- The README instructs the user to register with the malicious username "' or '1' = '1".
README.md:42-44 - The frontend JavaScript code sends the username to the backend via a POST request to /users without any client-side sanitization of SQL metacharacters.
app/src/main/resources/static/index.html:324-333 - The User entity maps the username field as the primary key (Id) and stores it directly from user input.
app/src/main/java/com/example/lab/domain/User.java:15-17 - The README states that triggering an update or delete on the malicious account will cause the SQL payload to be injected into the WHERE clause, affecting all rows.
README.md:46-53 - The frontend provides '정보 변경' (update) and '탈퇴' (delete) buttons for the currently logged-in user, which send PATCH and DELETE requests respectively.
app/src/main/resources/static/index.html:310-312app/src/main/resources/static/index.html:364-378
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- CVE-2026-0603 second-order SQL injection PoCThe artifact is a legitimate proof-of-concept for a known CVE, demonstrating the vulnerability through a user registration and bulk update/delete flow.
README.md:1-65 - Application Behavior
- User management CRUD operationsThe Java and HTML files implement standard create, read, update, and delete operations on user records, consistent with the described PoC.
app/src/main/resources/static/index.html:225-400app/src/main/java/com/example/lab/domain/User.java:1-40 - Startup Script
- start.sh initializes MariaDB and launches the Spring Boot applicationThe script sets up a local database and starts the vulnerable application; no external connections or hidden commands are present.
start.sh:1-16
What the analysis did not establish
- The backend controller code (e.g., the REST endpoints handling POST, PATCH, DELETE) is not included in the provided text files, so the exact server-side query construction cannot be verified.
- The application configuration file (e.g., application.yml) that would confirm the use of InlineIdsOrClauseBulkIdStrategy is not included.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are present.
- 7 text files were omitted from the evidence packet due to size constraints; their content was not reviewed.
- Binary files were not present in the artifact.
- The review is based solely on static source code analysis; runtime behavior was not observed.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2026-0603Dockerfile
Analysis
Environment assessment
A Dockerized Spring Boot web application (member management system) using Hibernate ORM 5.6.15 and MariaDB, designed as a vulnerability lab for CVE-2026-0603.
README.md:1-3Dockerfile:1-25Lab assessment
Vulnerability labThe README explicitly states it is a PoC for CVE-2026-0603, a Hibernate ORM second-order SQL injection. The code includes intentionally vulnerable bulk delete/update operations and configuration enabling the vulnerable InlineIdsOrClauseBulkIdStrategy.
README.md:1-3app/src/main/resources/application.yml:17-18app/src/main/java/com/example/lab/repo/UserRepository.java:14-27Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
start.sh
container entrypointdatabase initializationapplication launcher
Starts MariaDB, creates a 'lab' database and user, then runs the Spring Boot JAR.
start.sh:1-16Spring Boot application (app/)
vulnerable web applicationmember management system
A Spring Boot 2.7.18 application with Hibernate 5.6.15. Provides REST endpoints for user registration, listing, deletion, and email/department update. Uses JPA joined inheritance (User/UserProfile) and bulk operations vulnerable to second-order SQL injection.
app/pom.xml:1-61app/src/main/java/com/example/lab/web/UserController.java:1-56app/src/main/java/com/example/lab/repo/UserRepository.java:1-29index.html
web frontenduser interface for vulnerability exercise
A single-page HTML/JS frontend for the member management system. Allows user registration, viewing, editing, and deletion. Uses sessionStorage to track the current user and provides buttons to trigger the vulnerable update/delete operations.
app/src/main/resources/static/index.html:1-402application.yml
application configurationvulnerability enabler
Configures the MariaDB datasource, JPA with create-drop DDL, and explicitly sets the Hibernate bulk_id_strategy to InlineIdsOrClauseBulkIdStrategy, which is required for the CVE-2026-0603 vulnerability.
app/src/main/resources/application.yml:1-25How the supplied evidence relates each vulnerability
CVE-2026-0603
Supported by supplied evidence
The README describes CVE-2026-0603 as a second-order SQL injection in Hibernate ORM bulk operations. The code includes a vulnerable Hibernate version (5.6.15), the required InlineIdsOrClauseBulkIdStrategy configuration, and bulk delete/update repository methods that operate on user-supplied primary keys without sanitization, matching the described vulnerability.
README.md:1-65app/pom.xml:18-19app/src/main/resources/application.yml:17-18app/src/main/java/com/example/lab/repo/UserRepository.java:14-27Requirements and sequence described by the evidence
Prerequisites
- Docker must be installed to build and run the container.
README.md:30-33 - The application must be built and started using the provided Docker commands.
README.md:30-33 - The Hibernate bulk_id_strategy must be set to InlineIdsOrClauseBulkIdStrategy (already configured in application.yml).
app/src/main/resources/application.yml:17-18
Evidence-described exercise path
- Register a new user with a malicious username containing a SQL injection payload (e.g., ' or '1' = '1).
README.md:38-40 - Trigger the vulnerable update or delete operation on the registered account via the web UI.
README.md:42-43 - Observe that the bulk operation affects all user records, not just the targeted account, confirming the second-order SQL injection.
README.md:46-49
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is confined to the containerized lab environment. The application only listens on port 8080, connects to a local MariaDB instance, and performs expected CRUD operations. There is no evidence of host escape, external network connections, persistence outside the container, credential theft, or destructive behavior beyond the intended lab target.
Dockerfile:1-25start.sh:1-16app/src/main/resources/application.yml:5-8What the analysis did not establish
- No Docker Compose file is present; the environment is a single Dockerfile.
- The packet does not include any runtime logs or network captures to confirm actual exploit behavior.
- The README references an external video link (https://github.com/user-attachments/assets/...) which was not inspected.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.