fairyming/CVE-2019-11043

GitHubRepository PoC

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

CVE-2019-11043/docker-compose.yml

Created Vuln labCVE-2019-11043Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with an nginx:1 web server and a php:7.2.10-fpm backend, serving a simple PHP page. The README describes it as a vulnerable PHP server for reproducing CVE-2019-11043, a PHP-FPM remote code execution vulnerability.

CVE-2019-11043/docker-compose.yml:1-15CVE-2019-11043/README.md:1-51

Lab assessment

Vulnerability lab

The README explicitly states the environment is for reproducing CVE-2019-11043, a PHP remote code execution vulnerability, and provides setup and exploitation instructions.

CVE-2019-11043/README.md:1-51
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx

web serverreverse proxy

Serves static files from ./www and proxies PHP requests to the php service on port 9000. Exposes port 8080 on the host.

CVE-2019-11043/docker-compose.yml:3-11CVE-2019-11043/default.conf:1-27

php

PHP-FPM backend

Runs PHP 7.2.10-fpm, serving PHP files from the shared ./www volume. The README identifies it as the vulnerable target for CVE-2019-11043.

CVE-2019-11043/docker-compose.yml:12-15CVE-2019-11043/README.md:1-51
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-11043

Supported by supplied evidence

The README explicitly states the environment is for reproducing CVE-2019-11043, references the PHP bug report and a proof-of-concept tool, and provides steps to trigger remote code execution.

CVE-2019-11043/README.md:1-51
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to start the environment.CVE-2019-11043/README.md:15-17
  • The phuip-fpizdam tool (Go) must be available to run the exploit.CVE-2019-11043/README.md:21-23

Evidence-described exercise path

  1. Start the vulnerable environment with 'docker-compose up -d'.CVE-2019-11043/README.md:15-17
  2. Verify the default page is accessible at http://your-ip:8080/index.php.CVE-2019-11043/README.md:19
  3. Run the phuip-fpizdam tool against the target URL to detect and exploit the vulnerability.CVE-2019-11043/README.md:23-35
  4. Trigger remote code execution by visiting http://your-ip:8080/index.php?a=id.CVE-2019-11043/README.md:41-43
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The exploit targets the PHP-FPM service inside the container, and no behavior is shown to escape the container, compromise the host, or connect to external systems. Port mapping and volume mounts are standard for such labs.

CVE-2019-11043/docker-compose.yml:1-15CVE-2019-11043/README.md:1-51
Review boundaries

What the analysis did not establish

  • The exploit tool (phuip-fpizdam) is referenced but not included in the packet; its behavior cannot be inspected.
  • The packet includes two PNG images (1.png, 2.png) that are binary and uninspected.
  • The README.zh-cn.md file is present in the inventory but its content is not included in evidence_files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1