libasv/Exploite-CVE-2023-30212-vulnerability

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2023-30212Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a PHP 7.2 Apache container with MySQL, intended to host a vulnerable OURPHP application for demonstrating CVE-2023-30212 (XSS). The README provides build, run, and exploit instructions.

dockerfile:1-52README.md:1-91

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to 'create a vulnerable Docker environment that is susceptible to CVE-2023-30212' and provides step-by-step instructions to build, run, and exploit the vulnerability via a crafted URL.

README.md:1-3README.md:79-81
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

php:7.2-apache base image

web serverPHP runtime

Official PHP 7.2 Apache image serving as the base. Apache is configured with mod_rewrite enabled and document root set to /var/www/html. Exposes port 80.

dockerfile:2dockerfile:28dockerfile:31-33dockerfile:45

MySQL server

database server

Default MySQL server installed inside the container. A 'test' database is created during build. Started by the CMD instruction alongside Apache.

dockerfile:18-24dockerfile:48

Web application files

vulnerable application

Files copied from the build context into the document root. The file inventory includes admin.php, index.php, search.php, and others, suggesting a PHP application (likely OURPHP). The README references /client/manage/ourphp_out.php as the vulnerable endpoint.

dockerfile:36README.md:5README.md:79
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-30212

Insufficient evidence

The README claims the environment is susceptible to CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0 via /client/manage/ourphp_out.php. However, the supplied evidence does not include the actual application source code (e.g., ourphp_out.php) or any runtime demonstration of the vulnerability. The Dockerfile only sets up the infrastructure; the vulnerability cannot be confirmed from the provided artifacts.

README.md:1-5README.md:79
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed on the host to build and run the container.README.md:13-17
  • The Dockerfile and application files must be present in the build context.README.md:9-11
  • The container must be run with port mapping (e.g., -p 8080:80) to access the web server.README.md:27-29

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t test .'README.md:23-25
  2. Run the container with port mapping: 'docker run -d -p 8080:80 test'README.md:27-29
  3. Optionally, exec into the container to configure MySQL privileges (though not strictly required for the XSS exploit).README.md:37-75
  4. Trigger the XSS vulnerability by visiting 'http://localhost:8080/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert(xss)</script>'README.md:79
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and README describe a self-contained lab environment. The container runs Apache and MySQL internally, exposes only port 80, and does not mount host directories, run in privileged mode, or connect to external networks beyond the base image pull. The exploit URL targets the local container's web application. No hidden, destructive, or host-escaping behavior is evident.

dockerfile:1-52README.md:1-91
Review boundaries

What the analysis did not establish

  • The actual application source files (e.g., ourphp_out.php) are not included in the evidence, so the vulnerability cannot be verified.
  • The README contains placeholder commands and references an external download link for the Dockerfile, but the provided Dockerfile is already included.
  • The file inventory lists additional PHP files (admin.php, index.php, search.php) and a binary favicon.ico, but their contents are not provided, limiting full behavioral analysis.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1