sungmin20/cve-2023-30212

GitHubRepository PoC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yaml

Created Vuln labCVE-2023-30212Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a PHP 7.4 Apache container exposing port 8088. It copies a vulnerable LFI script and a malicious PHP script into the web root.

docker-compose.yaml:1-7Dockerfile:1-10

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2023-30212, a PHP LFI vulnerability, and the included files (vulnerable.php, malicious.php) are designed to demonstrate the exploit.

README.md:1-5
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve-lfi

vulnerable web serverexploit target

A PHP 7.4 Apache service built from the local Dockerfile. It serves vulnerable.php (LFI entry point) and malicious.php (command execution) on port 8088.

docker-compose.yaml:3-5Dockerfile:1-8

vulnerable.php

LFI vulnerability

A PHP script that includes a file specified by the 'file' GET parameter without sanitization, enabling local file inclusion.

vulnerable.php:1-5

malicious.php

payloadcommand execution

A PHP script that executes 'touch /tmp/pwned' via the system() function, used to demonstrate arbitrary command execution after LFI.

malicious.php:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-30212

Supported by supplied evidence

The README describes the environment as a PoC for CVE-2023-30212, and the provided vulnerable.php and malicious.php demonstrate a PHP LFI leading to remote code execution, consistent with the CVE description.

README.md:1-5vulnerable.php:1-5malicious.php:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:37-39
  • The container must be running and accessible on localhost port 8088.docker-compose.yaml:5README.md:43

Evidence-described exercise path

  1. Start the container with 'docker-compose up -d'.README.md:37-39
  2. Use the LFI vulnerability to read malicious.php source via php://filter.README.md:47-51
  3. Execute malicious.php directly to run the system command.README.md:59-61
  4. Verify command execution by checking for /tmp/pwned inside the container.README.md:63-67
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab container. The malicious.php payload only creates a file inside the container's /tmp, and there are no host volume mounts, privileged mode, or network connections to external systems. The exercise demonstrates the vulnerability without escaping the lab boundary.

docker-compose.yaml:1-7Dockerfile:1-10malicious.php:1
Review boundaries

What the analysis did not establish

  • The README mentions a base image of php:8.1-apache, but the Dockerfile uses php:7.4-apache; this discrepancy is not resolved.
  • The file index.html is present in the file inventory but not referenced in any evidence; its content is not provided.
  • The README contains embedded images that cannot be inspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1