MoxitPanchal/EverShop-Lab-CVE-2026-25993

GitHubRepository PoCWriteup

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a lab environment setup and a technical writeup describing CVE-2026-25993, a second-order SQL injection in EverShop. It provides Docker configuration, a README with vulnerability analysis and exploitation goals, and seed scripts, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Docker-based lab environment for CVE-2026-25993, a second-order SQL injection in EverShop. All reviewed files (Dockerfile, README.md, entrypoint.sh, seed.js) serve the stated educational purpose: deploying a vulnerable EverShop v2.1.0 instance, seeding demo data, and providing instructions for exploiting the vulnerability. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesDockerfileMarkdownShellJavaScript
Target softwareEverShop
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it provides a technical description of the vulnerability, setup instructions for a lab environment, and exploitation goals, but does not include any code that exploits or scans for the vulnerability. The Dockerfile, entrypoint.sh, and seed.js are for environment setup, not for exercising the vulnerability.

README.md:42-60Dockerfile:1-23entrypoint.sh:1-89seed.js:1-118

Requirements

  • Docker Engine 24+ with Docker Compose v2+ and 2 GB free RAM are required to deploy the lab environment.README.md:5-6

Observed behavior

  • The README describes the vulnerability as a second-order SQL injection in category URL rewrite processing, where the url_key field allows SQL metacharacters, and an event subscriber builds raw SQL via string concatenation.README.md:44
  • The README sets a goal to dump the entire database by extracting the PostgreSQL version, enumerating tables, and extracting row data.README.md:50-54
  • The entrypoint script sets up the EverShop application, creates an admin user, and seeds base data using seed.js.entrypoint.sh:63-75
  • The seed.js script populates the database with categories, products, a collection, and a widget for the lab environment.seed.js:19-106
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Software Deployment
EverShop v2.1.0 cloned from official repositoryThe Dockerfile (line 9) clones the vulnerable version of EverShop, which is the target of the CVE. This is expected for a PoC lab.Dockerfile:9
Database Seeding
seed.js creates categories, products, collection, and widgetThe seed script (lines 19-106) populates the database with demo data, which is necessary for a functional lab environment. No malicious data is inserted.seed.js:19-106
Admin User Creation
Admin user created with default credentials admin@evershop.io / password123The entrypoint script (lines 64-69) creates an admin user for the lab. The credentials are publicly documented in the README (lines 23-24) and are standard for a local test environment.entrypoint.sh:64-69README.md:23-24
Review boundaries

What the analysis did not establish

  • One file (docker-compose.yml) is omitted from the evidence, which may contain additional configuration details.
  • The evidence does not include the vulnerable application source code, only the lab setup and description.
  • One file (docker-compose.yml) was flagged as metadata-only and not analyzed; its content could contain additional configuration, but the reviewed files provide a complete and consistent picture of the lab's behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2026-25993Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for EverShop v2.1.0, consisting of a PostgreSQL database and an EverShop application server. The README explicitly labels it a lab for CVE-2026-25993, a second-order SQL injection vulnerability.

README.md:1docker-compose.yml:1-59

Lab assessment

Vulnerability lab

The README explicitly states 'CVE-2026-25993 — EverShop Second-Order SQL Injection Lab', describes the vulnerability, and provides a goal to dump the database. The Docker Compose and Dockerfile set up a specific vulnerable version (v2.1.0) of EverShop.

README.md:1README.md:27-29Dockerfile:7
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

evershop-db

database server

PostgreSQL 16 Alpine container storing EverShop data. Configured with a healthcheck and a named volume for persistence.

docker-compose.yml:2-15

evershop-app

application servervulnerable target

Node.js container built from the local Dockerfile. Clones EverShop v2.1.0, compiles it, and runs the application on port 3000. Exposes port 3000 to the host. The entrypoint script waits for the database, creates an admin user, seeds data, and starts the server.

docker-compose.yml:17-50Dockerfile:1-23entrypoint.sh:1-89
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-25993

Supported by supplied evidence

The README describes a second-order SQL injection in EverShop's category URL rewrite processing, matching the CVE identifier. The environment is explicitly built around this vulnerability, using the affected version v2.1.0.

README.md:1README.md:27-29Dockerfile:7
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine 24+ with Docker Compose v2+README.md:5
  • 2 GB free RAMREADME.md:6

Evidence-described exercise path

  1. Deploy the lab with 'docker compose up' and wait for it to start.README.md:10-12
  2. Access the application at http://localhost:3000.README.md:14
  3. Exploit the second-order SQL injection via category URL key manipulation to dump the database.README.md:27-29README.md:33-37
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The only port mapping is 3000:3000 for the web application. No privileged mode, host volume mounts, or external network connections are configured. The entrypoint script and seed script only interact with the local database and application. No hidden or unnecessary behavior is observed.

docker-compose.yml:1-59Dockerfile:1-23entrypoint.sh:1-89seed.js:1-118
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1