ishwardeepp/CVE-2025-26794-Exim-Mail-SQLi

GitHubRepository PoC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

files

Created Vuln labCVE-2025-26794Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based environment that builds Exim 4.98 from source with debug flags and SQLite support, copies a runtime configuration and a start script, and runs the Exim daemon. The repository name and start script comment suggest it is intended for CVE-2025-26794 research.

files/Dockerfile:1-36files/start-exim.sh:1-3

Lab assessment

Vulnerability lab

The repository is named 'CVE-2025-26794-Exim-Mail-SQLi', the Dockerfile builds a specific Exim version with debug symbols and SQLite, and the start script contains a commented-out lookup expression that resembles an SQL injection test, all consistent with a vulnerability reproduction environment.

files/Dockerfile:1-36files/start-exim.sh:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds Exim 4.98 with debug and SQLite supportcreates exim-demo usercopies start script and runtime config

A multi-stage Dockerfile based on Debian that installs build dependencies, clones the Exim repository, checks out tag exim-4.98, configures Local/Makefile with EXIM_USER=poc-user, AUTH_PLAINTEXT, USE_OPENSSL, USE_SQLITE, and debug flags, then builds and installs Exim. It copies start-exim.sh and a configure file into the image.

files/Dockerfile:1-36

start-exim.sh

starts Exim daemon with debug outputcontains commented SQL injection test

A shell script that runs '/usr/exim/bin/exim -bd -q30m -d' to start the Exim daemon in debug mode. It includes a commented-out line that appears to test an SQL injection via Exim's string expansion: '/usr/exim/bin/exim -d -be '${lookup {test'' AND 1=2 \* } dbm {/var/spool/exim/db/misc} }''.

files/start-exim.sh:1-3

configure

Exim runtime configuration

A standard Exim runtime configuration file with ACLs, routers, transports, and authenticators. It defines local_domains, relay controls, and a PLAIN authenticator with hardcoded credentials (username/mysecret). No SQLite-specific configuration is visible.

files/configure:1-1032

docker.sh

builds and runs the Docker container with elevated privileges

A shell script that builds the Docker image, removes any existing container, and runs a new container with --cap-add SYS_PTRACE, --security-opt seccomp=unconfined, port 25 exposed, and an interactive bash shell.

files/docker.sh:1-4

connect_docker.sh

execs into the running container

A one-line script that runs 'sudo docker exec -it exim bash' to attach to the running container.

files/connect_docker.sh:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-26794

Insufficient evidence

The packet provides no CVE description, advisory, or exploit code. The repository name and the SQL injection test in start-exim.sh suggest an association, but without a CVE record or documented vulnerability details, the association cannot be confirmed or denied.

files/start-exim.sh:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed and the user must have sudo privileges to run docker.sh.files/docker.sh:1-4
  • The Exim build requires network access to clone https://github.com/Exim/exim.git and install Debian packages.files/Dockerfile:1-36

Evidence-described exercise path

  1. Build the Docker image using 'sudo docker build -t exim .'files/docker.sh:1
  2. Run the container with elevated privileges and port 25 exposed.files/docker.sh:2-3
  3. Start the Exim daemon inside the container using start-exim.sh.files/start-exim.sh:1
  4. Optionally test the SQL injection by uncommenting and running the lookup expression in start-exim.sh.files/start-exim.sh:2
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to building and running Exim inside a Docker container. The container is run with --cap-add SYS_PTRACE and seccomp=unconfined, which are common for debugging but increase attack surface; however, no evidence shows host escape, external connections, persistence, or destructive actions. The SQL injection test targets the lab's own Exim instance.

files/docker.sh:1-4files/start-exim.sh:1-3
Review boundaries

What the analysis did not establish

  • No CVE description or exploit code is provided; the vulnerability details are unknown.
  • The packet does not include the Makefile-Linux file referenced in the file inventory, so its contents are uninspected.
  • The start script contains a commented-out SQL injection test, but its exact purpose and outcome are not documented.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1