shinthink/CVE-2026-65761

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-65761, an unauthenticated SQL injection in the EasyStore Joomla extension, by injecting into the filter_sortby direction parameter to perform time-based blind SQLi and extract database contents.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-65761, an unauthenticated SQL injection in the EasyStore Joomla extension. The script performs only the advertised SQL injection actions: time-based detection, database fingerprinting, and data extraction (users, configuration). No concealed executable behavior, persistence, credential exfiltration to an external party, or unrelated payload was observed. The code uses only Python standard library modules and makes requests solely to the user-supplied target URL.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareEasyStore for Joomla
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits the SQL injection vulnerability by constructing and sending malicious payloads to extract data from the target database, going beyond detection to achieve data exfiltration.

cve_2026_65761.py:33-45cve_2026_65761.py:75-87cve_2026_65761.py:117-130

Requirements

  • Target running EasyStore ≤ 2.0.1 with accessible product listingREADME.md:16README.md:94-97
  • Python 3.8+ with standard library onlyREADME.md:106requirements.txt:1

Observed behavior

  • Sends HTTP requests with SQL injection payload in filter_sortby parametercve_2026_65761.py:33-45
  • Performs time-based detection using SLEEP(5) to confirm vulnerabilitycve_2026_65761.py:47-51
  • Extracts database version, name, user, and table prefix via blind SQLicve_2026_65761.py:101-115
  • Dumps Joomla user credentials (username, email, name) from the databasecve_2026_65761.py:117-130
  • Extracts sensitive configuration including site secret and payment API keyscve_2026_65761.py:132-144
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
User-supplied --url argumentAll HTTP requests are sent only to the target specified by the user via the --url argument. No hardcoded external URLs or data exfiltration endpoints are present.cve_2026_65761.py:39cve_2026_65761.py:149cve_2026_65761.py:154
Imports
re, sys, time, argparse, urllib.parse, urllib.request, ssl, socketOnly Python standard library modules are imported. No third-party or obfuscated modules are used.cve_2026_65761.py:19cve_2026_65761.py:25
Ssl Configuration
ssl.CERT_NONE, check_hostname=FalseSSL certificate verification is disabled, which is a common practice in exploit PoCs to avoid connection errors against misconfigured targets. This does not constitute backdoor behavior.cve_2026_65761.py:26
Review boundaries

What the analysis did not establish

  • One file (19 bytes) omitted from analysis; classified as unclassified but not inspected
  • Evidence not executed; classification based solely on static analysis of provided source code
  • One file (LICENSE, 19 bytes) was omitted from the text evidence and was not reviewed. Its metadata suggests it is a standard MIT license file, which is unlikely to contain executable code.
  • The review is based solely on static analysis of the provided text; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1