Tenable Nessus 10.12.1 - SQL Injection

ExploitDBExploitDB exploitExploitEDB-52620

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that generates a malicious .nessus XML file containing SQL injection payloads in host property tags and plugin output. The file is intended to be imported by a privileged Nessus user to trigger SQL injection in the backend database.

Backdoor review

No backdoor observed in reviewed code

The PoC script generates a malicious .nessus XML file containing SQL injection payloads designed to exploit CVE-2026-57588. The script itself performs no backdoor, persistence, credential theft, or unrelated remote access actions. It only creates a file with the described exploit payloads and prints status messages.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareTenable Nessus
Attack typessql injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script constructs a malicious input file containing SQL injection payloads designed to be processed by a vulnerable Nessus instance, which constitutes exploit code intended to exercise the vulnerability.

exploits/multiple/webapps/52620.py:1exploits/multiple/webapps/52620.py:17-18exploits/multiple/webapps/52620.py:64-68exploits/multiple/webapps/52620.py:81-88

Requirements

  • Requires social engineering to trick a privileged user into importing the generated .nessus file via the Nessus web interface.exploits/multiple/webapps/52620.py:31exploits/multiple/webapps/52620.py:39-40

Observed behavior

  • Generates a .nessus XML file with SQL injection payloads embedded in host property tag values (e.g., UNION SELECT, pg_sleep, pg_read_file) and in plugin_output text.exploits/multiple/webapps/52620.py:64-68exploits/multiple/webapps/52620.py:81-88
  • Writes the crafted XML to a user-specified output file.exploits/multiple/webapps/52620.py:90-91
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Sql Injection Payload
evil-host' UNION SELECT NULL, current_database(), version(), user() --Payload embedded in the generated .nessus file to exfiltrate database information when imported by a victim.exploits/multiple/webapps/52620.py:64
Sql Injection Payload
Linux' AND (SELECT pg_sleep(5))=0 --Time-based blind SQL injection payload in the generated file.exploits/multiple/webapps/52620.py:65
Sql Injection Payload
192.168.1.1' OR '1'='1Boolean-based SQL injection payload in the generated file.exploits/multiple/webapps/52620.py:66
Sql Injection Payload
test' ; SELECT pg_read_file('/etc/passwd') --Payload attempting to read a local file on the database server via SQL injection.exploits/multiple/webapps/52620.py:67
Sql Injection Payload
Normal output\n' UNION ALL SELECT\n '=== DATA EXFIL START ===',\n table_name,\n column_name,\n '=== DATA EXFIL END ==='\nFROM information_schema.columns\nWHERE table_schema = current_schema() --Multi-line SQL injection payload in the generated file designed to enumerate database schema.exploits/multiple/webapps/52620.py:81-88
Review boundaries

What the analysis did not establish

  • Only the exploit script is provided; the vulnerable Nessus application and database backend are not included.
  • The script generates a payload file but does not perform the import or demonstrate successful exploitation.
  • Only the provided text of the PoC script was reviewed; no external dependencies, libraries, or the generated .nessus file were inspected.
  • The review does not assess the safety or functionality of the generated payloads when imported into Nessus.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1