SohelYousef/CVE-2024-58290-Xhibiter-SQLi

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a time-based blind SQL injection payload to the /collections endpoint and measures response delay to detect vulnerability CVE-2024-58290. It does not extract data or manipulate the database.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Python PoC script for CVE-2024-58290. The script sends a time-based SQL injection payload to a user-supplied URL to test for the vulnerability. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is observed. The script's actions are limited to the stated vulnerability detection.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareXhibiter NFT Marketplace
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only detects the vulnerability by measuring response delay; it does not extract data, modify the database, or establish a shell. The README describes it as a detection script, and the code confirms it performs a time-based check and reports success/failure.

README.md:25poc.py:6poc.py:44-50

Requirements

  • Target running Xhibiter NFT Marketplace 1.10.2 with accessible /collections endpointREADME.md:16poc.py:22

Observed behavior

  • Sends HTTP GET request to /collections with id parameter containing SLEEP(5) payloadpoc.py:28-30poc.py:39
  • Measures response time and reports vulnerability if delay >= 5 seconds or request times outpoc.py:37-40poc.py:44-54
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
requests.get(target_endpoint, params=params, timeout=15)The script sends an HTTP GET request to the user-provided URL with the SQL injection payload in the 'id' parameter. This is the core of the PoC and matches the described vulnerability.poc.py:39
Sql Injection Payload
1' AND (SELECT 5678 FROM (SELECT(SLEEP(5)))DwVr) AND '1'='1The payload is a standard time-based blind SQL injection test using SLEEP(5). It is used to detect the vulnerability and does not perform data exfiltration or system modification.poc.py:28
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md, poc.py) were reviewed; no binary files were present or inspected.
  • The review does not verify the script's behavior at runtime or the safety of the requests library.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1