CVE-2025-26198 Exploit Metadata

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

The artifact contains Python scripts (exploit.py, exploit_simple.py) that actively send crafted HTTP POST requests to a target loginlinkadmin.php endpoint to perform SQL injection. The code exercises the vulnerability by attempting authentication bypass, data extraction via UNION SELECT, time-based blind detection, and file read operations, which constitutes exploitation, not mere detection.

Backdoor review

No backdoor observed in reviewed code

The supplied text evidence (README.md, exploit.py, exploit_simple.py) describes and implements a standard educational SQL injection proof-of-concept for CVE-2025-26198. All code targets the declared vulnerable endpoint (loginlinkadmin.php) and performs only the advertised exploitation techniques (authentication bypass, data extraction, time-based detection, file read). No concealed executable behavior, persistence, credential exfiltration to an external host, or unrelated payload was observed. A binary PDF (Rapport.pdf) was present but not analyzed; its metadata-only inclusion is a limitation.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPythonMarkdown

Target softwareCloudClassroom-PHP-Project v1.0

Attack typesSQL Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The Python scripts actively exploit the SQL injection vulnerability by sending crafted payloads to the target application to achieve authentication bypass, data extraction, and file read. This is exploitation, not scanning or detection, as the code exercises the vulnerability to produce a tangible impact (e.g., logging in as admin, reading database contents).

exploit.py:55-78exploit.py:121-229exploit_simple.py:13-39

Requirements

A running instance of the vulnerable CloudClassroom-PHP-Project v1.0 with the loginlinkadmin.php endpoint accessible over HTTP.README.md:66exploit.py:19
Python 3.x with the 'requests' library installed.README.md:47-48exploit.py:10

Observed behavior

Sends an HTTP POST request to loginlinkadmin.php with a SQL injection payload in the username field to bypass authentication.exploit_simple.py:17-26exploit.py:58-67
Performs UNION-based SQL injection to extract database names, MySQL user, version, table names, and admin credentials from the backend database.exploit.py:121-229
Executes a time-based blind SQL injection by injecting a SLEEP() function and measuring response delay.exploit.py:235-271
Attempts to read server files (e.g., /etc/hostname) using the LOAD_FILE() MySQL function via SQL injection.exploit.py:277-321

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Endpoint: loginlinkadmin.phpAll exploit payloads are directed at the CVE-declared vulnerable component.exploit.py:19exploit_simple.py:14
Exploit Technique: SQL injection authentication bypass, union-based extraction, time-based blind, LOAD_FILEThe code implements exactly the four techniques advertised in the README and targets only the local test application.README.md:33-38exploit.py:55-78exploit.py:121-169exploit.py:235-271exploit.py:277-321
Network Communication: HTTP POST to localhost:8081/loginlinkadmin.phpAll network requests are directed at the local test infrastructure; no external exfiltration endpoints are present.exploit.py:19exploit_simple.py:14README.md:66

Review boundaries

What the analysis did not establish

One binary file (Rapport.pdf, 870645 bytes) was not analyzed; its content is unknown.
Seven additional text files in the repository were not included in the evidence packet; their content is unknown.
The evidence does not confirm whether the exploit code was executed or is functional against a live target.
One binary file (Rapport.pdf, 870645 bytes) was present but not analyzed per binary policy.
Seven text files present in the repository were omitted from the evidence packet; their content was not reviewed.
The review is limited to static analysis of the supplied text; no dynamic execution was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2026-01-11Vuln labCVE-2025-26198Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose environment for demonstrating CVE-2025-26198, a SQL injection vulnerability in CloudClassroom-PHP-Project v1.0. It consists of a MySQL 5.7 database and a PHP 8.1 Apache web server hosting a vulnerable admin login page.

docker-compose.yml:1-45README.md:1-307

Lab assessment

Vulnerability lab

The README explicitly states the project is an academic reproduction of CVE-2025-26198 for educational purposes, providing a vulnerable application and exploit scripts. The Docker Compose file sets up the vulnerable target.

README.md:1-10README.md:19-22

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database servervulnerable target dependency

MySQL 5.7 database initialized with a cloudclassroom schema, admin table, and test users. It is configured with --secure-file-priv='' and grants FILE privilege to dbuser, enabling LOAD_FILE() exploitation.

docker-compose.yml:4-18app/sql/init.sql:1-33app/sql/grant_file.sql:1-3

web

web servervulnerable application host

PHP 8.1 Apache server serving the CloudClassroom application from ./app. It exposes port 8081 and runs loginlinkadmin.php, which contains the SQL injection vulnerability.

docker-compose.yml:20-35app/loginlinkadmin.php:1-103

exploit.py

exploit scriptvulnerability demonstration tool

Python script that performs four SQL injection techniques against the target: boolean-based auth bypass, union-based data extraction, time-based blind detection, and file read via LOAD_FILE().

exploit.py:1-394

exploit_simple.py

exploit scriptvulnerability demonstration tool

A simpler Python script that performs a basic boolean-based SQL injection authentication bypass against the target.

exploit_simple.py:1-52

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-26198

Supported by supplied evidence

The vulnerable code in loginlinkadmin.php directly concatenates user input into a SQL query without sanitization, matching the described SQL injection. The exploit scripts demonstrate successful exploitation, and the README confirms the CVE association.

app/loginlinkadmin.php:27-30exploit.py:1-394README.md:19-22

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host.README.md:43-45
Python 3.x and the requests library installed on the host to run exploit scripts.README.md:46-47
The lab environment must be started with docker-compose up -d and MySQL must be ready before exploitation.README.md:50-57

Evidence-described exercise path

Start the lab environment using docker-compose up -d and wait for MySQL to initialize.README.md:50-57
Access the vulnerable login page at http://localhost:8081.README.md:59
Perform manual SQL injection by entering admin' OR '1'='1'-- - as username and any password.README.md:63-67
Run exploit_simple.py or exploit.py against the target to demonstrate automated exploitation.README.md:89-101README.md:103-140
Optionally switch to the patched version and verify that exploitation fails.README.md:144-160

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target containers. The exploit scripts only send HTTP requests to the local web service. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions outside the intended lab scope.

exploit.py:1-394exploit_simple.py:1-52docker-compose.yml:1-45

Review boundaries

What the analysis did not establish

The packet includes a binary PDF file (Rapport.pdf) that was not inspected; its content is unknown.
The exploit scripts are not executed in the supplied evidence; only static analysis was performed.
The lab uses --secure-file-priv='' and grants FILE privilege, which could be considered risky in a non-lab context, but is documented as part of the vulnerability demonstration.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2025-26198