BridgerAlderson/CVE-2026-24418

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (exploit.py) that exploits CVE-2026-24418, an error-based SQL injection vulnerability in OpenSTAManager <= 2.9.8. It authenticates to the target, injects SQL payloads via the id_records[] parameter in the Scadenzario module, and extracts data using EXTRACTVALUE error messages. The tool includes modules for database enumeration, credential dumping, file reading, webshell upload, and interactive command execution.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit script (exploit.py) and a README.md for CVE-2026-24418, an error-based SQL injection vulnerability in OpenSTAManager. The exploit performs standard SQL injection operations: database enumeration, credential dumping, file reading via LOAD_FILE(), and webshell upload/RCE via INTO DUMPFILE. All actions are user-initiated through command-line arguments and target a specified remote host. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential theft from the local machine, persistence, unrelated payloads) was observed. The code is straightforward and its functionality aligns with the documented CVE exploitation.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareOpenSTAManager
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits the SQL injection vulnerability to extract data, read files, and deploy a webshell for remote code execution. It is not a scanner, as it does not merely detect the vulnerability; it performs exploitation actions.

exploit.py:1-982README.md:29-47

Requirements

  • Valid user credentials or a session cookie for the target OpenSTAManager instance.exploit.py:124-173
  • The target must be running OpenSTAManager version <= 2.9.8 with the vulnerable Scadenzario module (id_module=18) accessible.README.md:12-14

Observed behavior

  • Authenticates to the target application using provided credentials or a PHPSESSID cookie.exploit.py:124-173
  • Sends a crafted POST request to /actions.php?id_module=18 with a malicious id_records[] parameter containing an EXTRACTVALUE-based SQL injection payload.exploit.py:193-215
  • Extracts data from the database by parsing XPATH syntax error messages in the HTTP response.exploit.py:210-215
  • Performs database reconnaissance, including retrieving version, current user, hostname, and file paths.exploit.py:265-291
  • Dumps user credentials from the zz_users table and exports them in hashcat and John the Ripper formats.exploit.py:544-617
  • Reads arbitrary files from the server's filesystem using the LOAD_FILE() MySQL function.exploit.py:331-353
  • Attempts to upload a PHP webshell to the webroot via an INTO DUMPFILE SQL statement and provides an interactive command execution interface.exploit.py:398-542
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Capability
Error-based SQL injection exploitation targeting OpenSTAManager <= 2.9.8The script sends crafted id_records[] payloads to /actions.php?id_module=18 to extract data via EXTRACTVALUE XPATH errors.exploit.py:197-205
Exploit Capability
Database enumeration, credential dumping, file read, webshell upload, and interactive command executionThe script provides options (--info, --users, --file-read, --webshell, --rce) to perform various post-exploitation activities on the target server.exploit.py:840-872
Network Behavior
All network requests are directed to the user-specified target URLThe script only communicates with the target provided via the -t/--target argument; no external or hardcoded C2 communication is present.exploit.py:100exploit.py:197
Review boundaries

What the analysis did not establish

  • The evidence includes a complete README.md and exploit.py. A third file (likely a license or similar) was omitted from the text content, but this does not affect the classification of the primary artifact.
  • One file (metadata only) was omitted from the evidence packet; its content was not reviewed.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1