CVE-2024-1698 Exploit Metadata

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Python script that performs unauthenticated time-based blind SQL injection against the NotificationX WordPress plugin to extract the admin username and password hash.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2024-1698. The script performs a time-based blind SQL injection against a hardcoded target URL to extract the admin username and password hash from a WordPress database. All behavior is consistent with the stated purpose of demonstrating the SQL injection vulnerability. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareNotificationX WordPress Plugin

Attack typesSQL Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (exploit.py) that actively exploits CVE-2024-1698 by sending crafted HTTP requests to extract sensitive data from a vulnerable target. The README describes it as an exploit and provides usage instructions.

exploit.py:1-71README.md:7

Requirements

Target WordPress site with NotificationX plugin version <= 2.8.2README.md:13
Python 3.6+ with requests libraryREADME.md:38-39

Observed behavior

Sends POST requests to /wp-json/notificationx/v1/analytics with a malicious 'type' parameter containing a time-based blind SQL injection payloadexploit.py:19-22
Determines admin username length by injecting IF(LENGTH(...)=N, SLEEP(delay), null) and measuring response timeexploit.py:18-29
Extracts admin username character by character using ASCII(SUBSTRING(...)) with SLEEP-based timingexploit.py:32-49
Extracts admin password hash using the same time-based blind technique on the user_pass columnexploit.py:52-71

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Target Url: http://192.168.100.10/wordpress/wp-json/notificationx/v1/analyticsThe exploit script targets a local/private IP address, indicating it is intended for a controlled test environment rather than a live attack.exploit.py:9
Sql Injection Payload: clicks`=IF(LENGTH((select user_login from wp_users where id=1))={length},SLEEP({delay}),null)-- -The payload extracts the admin username length via time-based blind SQL injection, consistent with the described vulnerability.exploit.py:21
Sql Injection Payload: clicks`=IF(ASCII(SUBSTRING((select user_login from wp_users where id=1),{idx_username},1))={ascii_val_username},SLEEP({delay}),null)-- -The payload extracts the admin username character by character, consistent with the described vulnerability.exploit.py:38
Sql Injection Payload: clicks`=IF(ASCII(SUBSTRING((select user_pass from wp_users where id=1),{idx_password},1))={ascii_val_password},SLEEP({delay}),null)-- -The payload extracts the admin password hash character by character, consistent with the described vulnerability.exploit.py:58

Review boundaries

What the analysis did not establish

Only the two text files (README.md and exploit.py) were reviewed; no binary or other files were present in the evidence packet.
The review does not assess whether the exploit works as claimed or is safe to execute in any environment.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2024-1698