CVE-2025-26794 has a selected CVSS score of 7.5 (high); EIP currently links 3 repository PoCs and 2 lab environments.
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 4.98 to < 4.98.1 | affected |
A Python-based exploit tool for CVE-2025-26794 that performs time-based blind SQL injection against Exim 4.98 via the ETRN command. It extracts database tables, columns, and data using binary search, and includes an interactive SQL query mode.
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2025-26794, an SQL injection vulnerability in Exim 4.98. The Python script (exploit.py) implements time-based blind SQL injection against a remote SMTP server using the ETRN command. All code is consistent with the stated purpose of authorized penetration testing and data extraction. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The script uses only standard library modules and performs no network activity beyond connecting to the user-supplied target.
The artifact contains functional Python code that actively exploits CVE-2025-26794 by sending malicious SQL injection payloads to extract data from a target Exim server. It is not limited to detection or scanning; it performs data extraction and includes an interactive query mode.
exploit.py:88-91exploit.py:110-149exploit.py:239-264README.md:24-27README.md:38-39exploit.py:81-83exploit.py:88-91exploit.py:184-188exploit.py:206-209exploit.py:110-149exploit.py:239-264exploit.py:53exploit.py:89exploit.py:46exploit.py:365-368This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker-based environment that builds Exim 4.98 from source with debug flags and SQLite support, copies a runtime configuration and a start script, and runs the Exim daemon. The repository name and start script comment suggest it is intended for CVE-2025-26794 research.
files/Dockerfile:1-36files/start-exim.sh:1-3The repository is named 'CVE-2025-26794-Exim-Mail-SQLi', the Dockerfile builds a specific Exim version with debug symbols and SQLite, and the start script contains a commented-out lookup expression that resembles an SQL injection test, all consistent with a vulnerability reproduction environment.
files/Dockerfile:1-36files/start-exim.sh:1-3A multi-stage Dockerfile based on Debian that installs build dependencies, clones the Exim repository, checks out tag exim-4.98, configures Local/Makefile with EXIM_USER=poc-user, AUTH_PLAINTEXT, USE_OPENSSL, USE_SQLITE, and debug flags, then builds and installs Exim. It copies start-exim.sh and a configure file into the image.
files/Dockerfile:1-36A shell script that runs '/usr/exim/bin/exim -bd -q30m -d' to start the Exim daemon in debug mode. It includes a commented-out line that appears to test an SQL injection via Exim's string expansion: '/usr/exim/bin/exim -d -be '${lookup {test'' AND 1=2 \* } dbm {/var/spool/exim/db/misc} }''.
files/start-exim.sh:1-3A standard Exim runtime configuration file with ACLs, routers, transports, and authenticators. It defines local_domains, relay controls, and a PLAIN authenticator with hardcoded credentials (username/mysecret). No SQLite-specific configuration is visible.
files/configure:1-1032A shell script that builds the Docker image, removes any existing container, and runs a new container with --cap-add SYS_PTRACE, --security-opt seccomp=unconfined, port 25 exposed, and an interactive bash shell.
files/docker.sh:1-4A one-line script that runs 'sudo docker exec -it exim bash' to attach to the running container.
files/connect_docker.sh:1Insufficient evidence
The packet provides no CVE description, advisory, or exploit code. The repository name and the SQL injection test in start-exim.sh suggest an association, but without a CVE record or documented vulnerability details, the association cannot be confirmed or denied.
files/start-exim.sh:1-3files/docker.sh:1-4files/Dockerfile:1-36files/docker.sh:1files/docker.sh:2-3files/start-exim.sh:1files/start-exim.sh:2All visible behavior is confined to building and running Exim inside a Docker container. The container is run with --cap-add SYS_PTRACE and seccomp=unconfined, which are common for debugging but increase attack surface; however, no evidence shows host escape, external connections, persistence, or destructive actions. The SQL injection test targets the lab's own Exim instance.
files/docker.sh:1-4files/start-exim.sh:1-3This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A Docker-based lab that builds Exim 4.98 from source with SQLite DBM support and a custom runtime configuration, intended to demonstrate CVE-2025-26794, a blind SQL injection in Exim's SQLite hints database.
docker_lab/Dockerfile:1-36README.md:1-127The README explicitly states the repository is for CVE-2025-26794, describes the vulnerability, and provides a local Docker lab to reproduce it. The Dockerfile builds Exim with SQLite support and copies a configuration that enables the ETRN command, matching the vulnerability requirements.
README.md:1-3README.md:85-90docker_lab/Dockerfile:20-22Exim 4.98 is cloned from GitHub, compiled with SQLite DBM support (USE_SQLITE=yes) and debug flags, and installed. The build is configured to run as user exim-demo.
docker_lab/Dockerfile:7-26A custom Exim configuration file is copied into the container. It defines an ACL for the ETRN command (acl_smtp_etrn) that accepts all ETRN requests, which is required for the SQL injection exploit.
docker_lab/Dockerfile:32docker_lab/configure:310-312A shell script that starts the Exim daemon in debug mode (-d) listening on port 25 and processing the queue every 30 minutes. It also contains a commented-out gdb command and a commented-out Exim expansion test.
docker_lab/start-exim.sh:1-3A Python script that connects to an Exim server on port 25, sends a benign ETRN command, then sends a time-based blind SQL injection payload via ETRN, and measures the response time to determine if the target is vulnerable.
docker_lab/test.py:1-60A shell script that builds the Docker image, removes any existing container, runs a new container with SYS_PTRACE capability, seccomp unconfined, port 25 published, and then opens an interactive bash shell inside the container.
docker_lab/docker.sh:1-4A shell script that executes an interactive bash shell in the running 'exim' container.
docker_lab/connect_docker.sh:1Supported by supplied evidence
The README describes a blind SQL injection in Exim 4.98 when SQLite is used as the DBM and the ETRN command is enabled. The Dockerfile builds Exim 4.98 with USE_SQLITE=yes, and the provided configure file enables the ETRN ACL. The start-exim.sh script starts Exim with debug output, and test.py demonstrates a time-based blind SQL injection payload via the ETRN command. All visible evidence aligns with the CVE description.
README.md:1-3docker_lab/Dockerfile:20-22docker_lab/configure:310-312docker_lab/test.py:30-45docker_lab/Dockerfile:20-22docker_lab/configure:310-312docker_lab/docker.sh:3docker_lab/docker.sh:1-4docker_lab/start-exim.sh:1README.md:93-95README.md:96-98README.md:98docker_lab/test.py:30-45All visible behavior is directed at the contained lab target (Exim 4.98 with SQLite). The Dockerfile builds and runs Exim locally, the test script connects to localhost:25, and the start script only launches the Exim daemon. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.
docker_lab/Dockerfile:1-36docker_lab/docker.sh:1-4docker_lab/test.py:1-60This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.