CVE-2025-26794

This repository contains a working proof-of-concept for CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when using SQLite as the DBM. The exploit leverages the ETRN command to inject arbitrary SQLite queries, demonstrated via a time-based payload.

This repository contains a functional Python-based exploit for CVE-2025-26794, demonstrating SQL injection in Exim 4.98 via the ETRN command when using SQLite DBM storage. The exploit includes time-based blind SQL injection techniques for data extraction and automated database enumeration.

The repository contains Docker setup scripts for Exim but lacks actual exploit code for CVE-2025-26794. The commented SQLi payload in start-exim.sh suggests an SQL injection vulnerability but is not functional.