SowatKheang/CVE_2026_2576_PoC

GitHubRepository PoCExploitPython

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a fully functional time-based blind SQL injection exploit targeting CVE-2026-2576 in the Business Directory Plugin for WordPress. It includes a Python script (poc.py) that sends crafted HTTP requests to extract database contents character by character using binary search and parallel threading.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept for CVE-2026-2576, a time-based blind SQL injection in the Business Directory Plugin for WordPress. All supplied text files (README, Docker Compose, SQL seed, Python PoC scripts, and shell setup) describe and implement the claimed vulnerability exploitation against a local lab environment. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed. The PoC performs only the advertised SQL injection extraction.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonShellSQLPHP
Target softwareBusiness Directory Plugin – Easy Listing Directories for WordPress
Attack typesSQL InjectionTime-Based Blind SQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is the Python script 'poc.py', which actively exploits the SQL injection vulnerability by sending malicious HTTP requests to extract data from the target database. This is confirmed by the script's core functions: 'oracle' sends time-based payloads, 'extract_char' performs binary search extraction, and 'cmd_dump' exfiltrates entire table rows. The README explicitly labels it a 'PoC' and provides commands to 'detect' and 'extract' data.

cve-2026-2576-lab/poc/poc.py:1-5cve-2026-2576-lab/poc/poc.py:82-89cve-2026-2576-lab/poc/poc.py:96-112cve-2026-2576-lab/poc/poc.py:234-263README.md:1

Requirements

  • A target running a vulnerable version (<= 6.4.21) of the Business Directory Plugin with a valid payment_key.README.md:29cve-2026-2576-lab/poc/poc.py:279-281

Observed behavior

  • Sends HTTP GET requests to the vulnerable checkout endpoint with a crafted 'payment[]' parameter containing a time-based SQL injection payload.cve-2026-2576-lab/poc/poc.py:61-66cve-2026-2576-lab/poc/poc.py:82-89
  • Uses a binary search algorithm on ASCII values to extract characters from database query results one by one.cve-2026-2576-lab/poc/poc.py:96-112
  • Employs multi-threading to extract multiple character positions in parallel, speeding up data exfiltration.cve-2026-2576-lab/poc/poc.py:151-154
  • Provides commands to detect the vulnerability, extract database metadata, list tables, dump table contents, and run custom SQL queries.cve-2026-2576-lab/poc/poc.py:289-293
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit
Time-based blind SQL injection via payment[] parameterThe PoC exploits CVE-2026-2576 to extract database contents using SLEEP-based timing oracles.cve-2026-2576-lab/poc/poc.py:82-89README.md:120-130
Lab Environment
Docker Compose lab with WordPress 6.4, MySQL 8.0, and vulnerable plugin 6.4.21The repository provides a fully containerized lab for safe, isolated testing of the SQL injection.cve-2026-2576-lab/docker-compose.yml:1-113cve-2026-2576-lab/setup.sh:1-137
Test Data
Seeded lab_secrets table with flag FLAG{sqli_time_based_extraction_success}The init-db.sql creates a dummy secrets table to demonstrate data extraction, not to exfiltrate real credentials.cve-2026-2576-lab/init-db.sql:13-23
Review boundaries

What the analysis did not establish

  • Two non-text media files (images) totaling 613,861 bytes were not analyzed; they are referenced in the README as screenshots of expected output and are unlikely to alter the classification.
  • The evidence packet reports 'complete_artifact_coverage: false' because the full repository snapshot exceeded the single-packet budget, but all 6 selected text files are provided in their entirety.
  • Two non-text media files (images referenced in README) and two unclassified files were not analyzed; their content is unknown.
  • Two text files (likely .gitignore and uploads.ini) were omitted from the packet and not reviewed.
  • The review is limited to static analysis of the supplied text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

cve-2026-2576-lab/docker-compose.yml

Created Vuln labCVE-2026-2576Compose · images

1 Compose manifest · 4 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for researching CVE-2026-2576, a time-based blind SQL injection in the Business Directory Plugin for WordPress. It deploys MySQL 8.0, WordPress 6.4 with the vulnerable plugin version 6.4.21, a one-shot setup container to install and seed the lab, and an optional phpMyAdmin service.

cve-2026-2576-lab/docker-compose.yml:1-113README.md:1-412

Lab assessment

Vulnerability lab

The README explicitly states the environment is for 'authorised security research and educational purposes only' and provides detailed steps to reproduce CVE-2026-2576. The compose file, setup script, and PoC scripts are all designed to create a vulnerable WordPress instance and demonstrate the SQL injection.

README.md:1-4cve-2026-2576-lab/docker-compose.yml:3-5
Lab shapeCompose · images
Services4
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MySQL 8.0 container that stores WordPress data and a custom lab_secrets table for extraction testing. It is initialized with init-db.sql which creates the lab_secrets table and inserts test secrets.

cve-2026-2576-lab/docker-compose.yml:14-30cve-2026-2576-lab/init-db.sql:1-23

wp

web servervulnerable application

WordPress 6.4 container with Apache, serving the vulnerable Business Directory Plugin. It exposes port 8080 on the host for access to the lab target.

cve-2026-2576-lab/docker-compose.yml:32-52

setup

one-shot installer

A temporary container that runs setup.sh to install WordPress, download and activate the vulnerable plugin version 6.4.21, create a Business Directory page, seed a payment record, and create a victim user. It exits after completion.

cve-2026-2576-lab/docker-compose.yml:54-76cve-2026-2576-lab/setup.sh:1-137

pma

database administration tool

Optional phpMyAdmin container for inspecting the MySQL database. It is not required for the vulnerability exercise.

cve-2026-2576-lab/docker-compose.yml:78-90

poc.py

exploit script

Python script that implements the time-based blind SQL injection PoC. It sends crafted HTTP requests to the vulnerable WordPress endpoint and extracts data by measuring response delays.

cve-2026-2576-lab/poc/poc.py:1-314

patch_diff.py

patch analysis tool

Python script that downloads the vulnerable and patched versions of the plugin and diffs the relevant files to show the exact code changes that fixed the vulnerability.

cve-2026-2576-lab/poc/patch_diff.py:1-217
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-2576

Supported by supplied evidence

The entire lab is built around this CVE. The README describes the vulnerability, affected versions, and patch. The compose file pins the vulnerable plugin version 6.4.21, and the PoC script demonstrates the time-based blind SQL injection via the payment[] parameter.

README.md:1-4cve-2026-2576-lab/docker-compose.yml:3-5cve-2026-2576-lab/poc/poc.py:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose v2 installed on the host.README.md:155-156
  • Python 3.9+ with requests and colorama libraries installed.README.md:157-160
  • Internet access to pull Docker images and download the vulnerable plugin.README.md:158

Evidence-described exercise path

  1. Start the lab stack with 'docker compose up -d'.README.md:170-172
  2. Run the one-shot setup container to install WordPress and the vulnerable plugin.README.md:174-176
  3. Confirm the vulnerable plugin version is 6.4.21.README.md:195-199
  4. Retrieve the payment_key from the database.README.md:201-203
  5. Run the PoC script to detect the injection, extract database metadata, list tables, dump table contents, or run custom SQL.README.md:212-240
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the WordPress container on port 8080). The PoC script only sends HTTP requests to localhost:8080. The setup script installs a known vulnerable plugin and seeds test data. No evidence of host escape, external connections, persistence outside the lab, credential theft, or destructive actions beyond the intended vulnerability demonstration.

cve-2026-2576-lab/poc/poc.py:1-314cve-2026-2576-lab/setup.sh:1-137cve-2026-2576-lab/docker-compose.yml:1-113
Review boundaries

What the analysis did not establish

  • The packet includes two PNG image files (detect.png, extract_db.png) that are binary and uninspected; their content cannot be assessed.
  • The PoC script and patch_diff.py are Python scripts that could perform additional actions when executed, but static analysis shows only HTTP requests to the lab target and file downloads from wordpress.org.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1