AdamWen230/CVE-2023-39539-PoC

GitHubRepository PoC

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2023-39539Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a Cacti 1.2.22 web application with a MySQL 5.7 database, intended as a target for CVE-2023-39539 exploitation.

docker-compose.yml:1-21README.md:1-2

Lab assessment

Vulnerability lab

The README explicitly states 'PoC for CVE-2023-39539 in Cacti 1.2.22', and the Docker Compose file sets up a Cacti 1.2.22 service, matching the described target. The included Python script (poc.py) is a proof-of-concept exploit for this CVE.

README.md:1-2docker-compose.yml:4poc.py:1-89
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable target application

Runs Cacti 1.2.22 from the vulhub/cacti:1.2.22 image, exposed on host port 8080. Uses a custom entrypoint script to initialize the database and start Apache.

docker-compose.yml:3-15entrypoint.sh:1-20

db

database backend

MySQL 5.7 database service with root password 'root' and a database named 'cacti', used by the Cacti application.

docker-compose.yml:16-21

entrypoint.sh

database initializationservice startup

A bash script mounted into the web container. It installs python3, waits for the database, imports cacti.sql if needed, sets admin password change flag, sets timezone, and then executes the provided command (apache2-foreground).

entrypoint.sh:1-20

poc.py

exploit script

A Python script that authenticates to the Cacti web interface, exploits an SQL injection in graphs.php to update the path_php_binary setting with a reverse shell command, triggers the reverse shell via host.php, and then attempts to restore the original setting.

poc.py:1-89
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-39539

Supported by supplied evidence

The README and the exploit script both target CVE-2023-39539. The script exploits an authenticated SQL injection in graphs.php 'site_id' parameter of Cacti 1.2.22, which matches the CVE description.

README.md:1-2poc.py:1-89
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.docker-compose.yml:1
  • Valid Cacti credentials (username and password) for the target instance.poc.py:67-68
  • A listener on the attacker's machine to receive the reverse shell (lhost and lport).poc.py:69-70

Evidence-described exercise path

  1. Start the lab environment using docker-compose up.docker-compose.yml:1-21
  2. Run the exploit script poc.py with target URL, credentials, and attacker listener details.poc.py:66-70
  3. The script logs in, sends the SQL injection payload to update the PHP binary path to a reverse shell command, triggers the shell, and attempts to restore the setting.poc.py:30-65
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets the lab's own Cacti container and opens a reverse shell to an operator-specified listener. This is expected behavior for a vulnerability lab. No evidence of host compromise, persistence, data destruction, or actions against unrelated systems is present.

poc.py:30-65
Review boundaries

What the analysis did not establish

  • The packet does not include the Cacti application source code or the cacti.sql file, so the exact vulnerable code path cannot be verified.
  • The vulhub/cacti:1.2.22 image is not inspected; its contents are unknown beyond the Dockerfile and entrypoint behavior.
  • The exploit script's recover_payload may not fully restore the original setting, but this is a limitation of the PoC, not a malicious indicator.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1