HackSpeak/CVE-2026-17566

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to pgAdmin 4, enumerates servers, and sends a crafted POST request to /import_export/job/<sid> with a malicious SQL query designed to exploit CVE-2026-17566. The payload injects a TO PROGRAM clause into a psql \copy command, aiming for remote code execution on the pgAdmin host.

Backdoor review

No backdoor observed in reviewed code

The PoC implements the documented CVE-2026-17566 exploit path: login, enumerate servers, and POST a crafted query to /import_export/job/<sid> to trigger RCE via psql TO PROGRAM injection. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The code is a straightforward exploit script with no hidden functionality.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwarepgAdmin 4
Attack typesOS command injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively performs the steps required to exploit CVE-2026-17566: it authenticates, performs reconnaissance, constructs a payload that injects an OS command into a psql \copy command, and sends it to the vulnerable endpoint. This is code intended to exercise a vulnerability, not merely detect it.

pgadmin4_rce_poc.py:1-221README.md:1-3

Requirements

  • Authenticated low-privilege pgAdmin user with tools_import_export_data permissionREADME.md:26
  • Network access to a pgAdmin 4 instance < 9.18README.md:27-28

Observed behavior

  • Logs into pgAdmin by fetching /login for a CSRF token and posting credentialspgadmin4_rce_poc.py:67-95
  • Enumerates available database servers via GET /browser/serverspgadmin4_rce_poc.py:98-112
  • Constructs a malicious SQL query containing a TO PROGRAM clause to execute an arbitrary OS commandpgadmin4_rce_poc.py:115-128
  • Sends the crafted payload via POST /import_export/job/<sid> to trigger the vulnerabilitypgadmin4_rce_poc.py:131-155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Crafted SQL query with backslash-escape mismatch to inject TO PROGRAM clauseThe build_query method constructs a payload that exploits the parenthesis-balance checker's misinterpretation of backslash-escaped quotes, enabling command execution via psql's popen().pgadmin4_rce_poc.py:116-128
Command Execution
Arbitrary command or reverse shell execution on target serverThe script accepts --command or --reverse arguments and passes them to the trigger method, which sends the exploit payload to the vulnerable endpoint.pgadmin4_rce_poc.py:165-187pgadmin4_rce_poc.py:131-155
Authentication Flow
Standard pgAdmin login with CSRF token extractionThe login method performs a GET /login to extract the _form_token, then POSTs credentials. This is normal exploit behavior for authenticated RCE.pgadmin4_rce_poc.py:67-95
Review boundaries

What the analysis did not establish

  • The author states the script is 'NOT TESTED against a live instance' and 'request body field names may need minor adjustment' (pgadmin4_rce_poc.py lines 14-16).
  • One file (total 3) is omitted from the evidence packet; its content is not available for analysis.
  • One file (LICENSE) was present in the repository but not included as text content; it is a standard MIT license file and unlikely to contain executable behavior.
  • The PoC author states the script was not tested against a live instance; the review assesses only the supplied code, not its runtime behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1