CVE-2026-25993

CRITICAL

EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-25993 has a selected CVSS score of 9.3 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 10, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

evershop

Browse evershopcommerce / evershop
CVE List< 2.1.1affected

Proofs of concept

1

Repository PoCs

GitHubMoxitPanchal/EverShop-Lab-CVE-2026-25993Repository PoCby MoxitPanchal1Writeup5 files

11.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a lab environment setup and a technical writeup describing CVE-2026-25993, a second-order SQL injection in EverShop. It provides Docker configuration, a README with vulnerability analysis and exploitation goals, and seed scripts, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Docker-based lab environment for CVE-2026-25993, a second-order SQL injection in EverShop. All reviewed files (Dockerfile, README.md, entrypoint.sh, seed.js) serve the stated educational purpose: deploying a vulnerable EverShop v2.1.0 instance, seeding demo data, and providing instructions for exploiting the vulnerability. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesDockerfileMarkdownShellJavaScript
Target softwareEverShop
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it provides a technical description of the vulnerability, setup instructions for a lab environment, and exploitation goals, but does not include any code that exploits or scans for the vulnerability. The Dockerfile, entrypoint.sh, and seed.js are for environment setup, not for exercising the vulnerability.

README.md:42-60Dockerfile:1-23entrypoint.sh:1-89seed.js:1-118

Requirements

  • Docker Engine 24+ with Docker Compose v2+ and 2 GB free RAM are required to deploy the lab environment.README.md:5-6

Observed behavior

  • The README describes the vulnerability as a second-order SQL injection in category URL rewrite processing, where the url_key field allows SQL metacharacters, and an event subscriber builds raw SQL via string concatenation.README.md:44
  • The README sets a goal to dump the entire database by extracting the PostgreSQL version, enumerating tables, and extracting row data.README.md:50-54
  • The entrypoint script sets up the EverShop application, creates an admin user, and seeds base data using seed.js.entrypoint.sh:63-75
  • The seed.js script populates the database with categories, products, a collection, and a widget for the lab environment.seed.js:19-106
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Software Deployment
Payload withheldThe Dockerfile (line 9) clones the vulnerable version of EverShop, which is the target of the CVE. This is expected for a PoC lab.Dockerfile:9
Database Seeding
Payload withheldThe seed script (lines 19-106) populates the database with demo data, which is necessary for a functional lab environment. No malicious data is inserted.seed.js:19-106
Admin User Creation
Payload withheldThe entrypoint script (lines 64-69) creates an admin user for the lab. The credentials are publicly documented in the README (lines 23-24) and are standard for a local test environment.entrypoint.sh:64-69README.md:23-24
Review boundaries

What the analysis did not establish

  • One file (docker-compose.yml) is omitted from the evidence, which may contain additional configuration details.
  • The evidence does not include the vulnerable application source code, only the lab setup and description.
  • One file (docker-compose.yml) was flagged as metadata-only and not analyzed; its content could contain additional configuration, but the reviewed files provide a complete and consistent picture of the lab's behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

MoxitPanchal/EverShop-Lab-CVE-2026-25993Created Vuln labCVE-2026-25993Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for EverShop v2.1.0, consisting of a PostgreSQL database and an EverShop application server. The README explicitly labels it a lab for CVE-2026-25993, a second-order SQL injection vulnerability.

README.md:1docker-compose.yml:1-59

Lab assessment

Vulnerability lab

The README explicitly states 'CVE-2026-25993 — EverShop Second-Order SQL Injection Lab', describes the vulnerability, and provides a goal to dump the database. The Docker Compose and Dockerfile set up a specific vulnerable version (v2.1.0) of EverShop.

README.md:1README.md:27-29Dockerfile:7
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

evershop-db

database server

PostgreSQL 16 Alpine container storing EverShop data. Configured with a healthcheck and a named volume for persistence.

docker-compose.yml:2-15

evershop-app

application servervulnerable target

Node.js container built from the local Dockerfile. Clones EverShop v2.1.0, compiles it, and runs the application on port 3000. Exposes port 3000 to the host. The entrypoint script waits for the database, creates an admin user, seeds data, and starts the server.

docker-compose.yml:17-50Dockerfile:1-23entrypoint.sh:1-89
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-25993

Supported by supplied evidence

The README describes a second-order SQL injection in EverShop's category URL rewrite processing, matching the CVE identifier. The environment is explicitly built around this vulnerability, using the affected version v2.1.0.

README.md:1README.md:27-29Dockerfile:7
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine 24+ with Docker Compose v2+README.md:5
  • 2 GB free RAMREADME.md:6

Evidence-described exercise path

  1. Deploy the lab with 'docker compose up' and wait for it to start.README.md:10-12
  2. Access the application at http://localhost:3000.README.md:14
  3. Exploit the second-order SQL injection via category URL key manipulation to dump the database.README.md:27-29README.md:33-37
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The only port mapping is 3000:3000 for the web application. No privileged mode, host volume mounts, or external network connections are configured. The entrypoint script and seed script only interact with the local database and application. No hidden or unnecessary behavior is observed.

docker-compose.yml:1-59Dockerfile:1-23entrypoint.sh:1-89seed.js:1-118
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2