This vulnerability allows attackers to:

• Extract sensitive data from the mail server database
• Perform time-based blind SQL injection attacks
• Enumerate database structure (tables, columns, data)

Affected Versions

• Exim 4.98 with SQLite DBM configuration

Attack Vector

• Network-accessible SMTP service (typically port 25)
• No authentication required (ETRN command available pre-auth)

🚀 Features

• Vulnerability Testing: Automated check to confirm if target is vulnerable
• Time-based Blind SQLi: Uses SQLite time-delay techniques for data extraction
• Binary Search Optimization: Efficient character-by-character extraction
• Automated Database Dump: Extracts tables, columns, and sample data
• Interactive Mode: Execute custom SQL queries interactively
• Multi-mode Operation: Flexible extraction strategies

📦 Installation

Requirements

• Python 3.6 or higher
• Network access to target SMTP server

Setup

💻 Usage

Basic Syntax

Quick Examples

1. Test if Target is Vulnerable

2. Automated Database Dump

3. Interactive SQL Query Mode

4. Extract Specific Table Structure

5. Execute Custom SQL Query

Command-Line Options

🔍 How It Works

Attack Flow

1. Connection: Establishes SMTP connection to target server
2. Baseline Measurement: Sends normal ETRN command to measure response time
3. Injection Test: Sends time-delay SQL payload to confirm vulnerability
4. Data Extraction: Uses binary search with time-based blind SQLi to extract data character-by-character

SQL Injection Payload Structure

The payload exploits improper sanitization in the ETRN serialization handler, allowing SQL injection into SQLite queries.

Time-Based Detection

Uses SQLite-specific time delay:

This creates a measurable delay (~1-2 seconds) when condition is true.

📊 Example Output

🛡️ Mitigation

If you are running Exim 4.98 with SQLite DBM:

1. Update Exim: Upgrade to patched version (4.98.1 or later)
2. Input Validation: Implement strict ETRN command validation
3. Parameterized Queries: Use prepared statements for all database operations
4. Firewall Rules: Restrict SMTP access to trusted networks
5. Disable ETRN: If not needed, disable ETRN command in Exim configuration

🔧 Technical Details

Binary Search Algorithm

The exploit uses binary search to efficiently extract characters:

• ASCII printable range: 32-126
• Average queries per character: ~7 (log₂ 94)
• Optimized for minimal network traffic

SQLite Functions Used

• unicode(): Get ASCII value of character
• substr(): Extract substring from result
• sqlite_master: System table for schema enumeration
• pragma_table_info(): Column metadata extraction

📚 References

• CVE Details: CVE-2025-26794
• Exim Security Advisory: [Official Exim Advisory]
• OWASP SQL Injection: OWASP Guide

🤝 Contributing

Contributions are welcome for:

• Performance optimizations
• Additional extraction techniques
• Detection evasion methods
• Bug fixes and improvements

Please ensure all contributions include:

• Clear documentation
• Responsible disclosure guidelines
• Legal usage warnings

📝 License

This project is released for educational purposes only. Use responsibly and legally.

👤 Author

XploitGh0st

• GitHub: @XploitGh0st

🙏 Acknowledgments

• Exim development team for responsible vulnerability handling
• Security research community
• SQLite time-based injection technique researchers

⚖️ Responsible Disclosure

If you discover vulnerabilities using this tool:

1. Do not publicly disclose details immediately
2. Contact the vendor/maintainer privately
3. Allow reasonable time for patching (typically 90 days)
4. Follow coordinated disclosure guidelines

Remember: With great power comes great responsibility. Use this tool ethically and legally.