flame-11/CVE-2016-15041-mainwp-dashboard

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Bash script (poc.sh) that exploits CVE-2016-15041, an unauthenticated stored XSS vulnerability in MainWP Dashboard <= 3.1.2. It fetches a nonce, injects a JavaScript payload via the mwp_setup_purchase_username parameter, and verifies the payload is stored.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, README, and a PoC shell script for CVE-2016-15041, a stored XSS vulnerability in the MainWP Dashboard WordPress plugin. The Dockerfile builds a lab environment, the README documents the vulnerability and usage, and the PoC script demonstrates the unauthenticated XSS injection. No backdoor, deceptive payload, or concealed operator-directed harm is present. The PoC script performs only the documented XSS proof-of-concept actions: fetching a nonce, injecting a benign alert() payload, and verifying storage. No persistence, credential theft, unrelated remote access, or hidden executable behavior is observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesShell
Target softwareMainWP Dashboard WordPress plugin
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively injects a malicious payload into a vulnerable application and verifies its storage, which constitutes exploitation, not just detection.

scripts/poc.sh:2scripts/poc.sh:28-34

Requirements

  • Target running MainWP Dashboard plugin version <= 3.1.2README.md:52
  • Network access to the target WordPress instancescripts/poc.sh:7

Observed behavior

  • Fetches a CSRF nonce from the unauthenticated setup wizard endpointscripts/poc.sh:16-17
  • Constructs an XSS payload that breaks out of an HTML attribute using a double quote and injects an onmouseover event handlerscripts/poc.sh:29
  • Sends a POST request with the XSS payload to the vulnerable endpoint without authenticationscripts/poc.sh:31-34
  • Verifies the payload is stored by checking for a unique marker in the responsescripts/poc.sh:41
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
" onmouseover="alert(document.domain)" x="The PoC script injects a benign XSS payload that triggers an alert with the document domain, consistent with a standard proof-of-concept for a stored XSS vulnerability.scripts/poc.sh:29
Vulnerability Target
CVE-2016-15041The artifact is a lab and PoC for a known CVE, with no indication of additional malicious functionality beyond demonstrating the vulnerability.README.md:1-3
Review boundaries

What the analysis did not establish

  • A binary zip file (mainwp-3.1.2-vulnerable.zip) is present but was not analyzed; its contents could contain additional exploit or scanner code.
  • Only 3 of 7 total files were provided as text; the remaining 4 files (including the binary) were omitted or not analyzed.
  • One binary file (mainwp-3.1.2-vulnerable.zip, 2.5 MB) was not analyzed; only its metadata is included. The PoC script does not interact with this file, and the Dockerfile only unzips it for lab setup. No backdoor indicators are present in the analyzed text, but the zip contents were not inspected.
  • Three text files (docker-compose.yml, docker-entrypoint-custom.sh, and one other) are present in the repository but their content is omitted from the evidence packet. The included files do not reference any suspicious behavior in these omitted files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2016-15041Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a WordPress 6.2 instance with a vulnerable MainWP Dashboard plugin (version 3.1.2) for demonstrating CVE-2016-15041, an unauthenticated stored XSS vulnerability.

docker-compose.yml:1-33Dockerfile:1-40README.md:1-83

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Vulnerable lab for CVE-2016-15041', the Dockerfile installs a patched vulnerable plugin, and a PoC script is provided to exercise the XSS.

README.md:1-3Dockerfile:3-12scripts/poc.sh:1-3
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

MySQL database server

MySQL 5.7.44 service providing the database backend for WordPress, with healthcheck and persistent volume.

docker-compose.yml:2-15

wordpress

WordPress application servervulnerable target

WordPress 6.2 container built from a custom Dockerfile that installs the vulnerable MainWP Dashboard plugin and a custom entrypoint for automated setup.

docker-compose.yml:17-28Dockerfile:1-40

docker-entrypoint-custom.sh

automated lab setup script

Custom entrypoint that waits for MySQL, installs WordPress via WP-CLI, activates the vulnerable plugin, and prints lab access information.

docker-entrypoint-custom.sh:1-58

mainwp-3.1.2-vulnerable.zip

vulnerable plugin archive

ZIP archive containing the MainWP Dashboard plugin version 3.1.2 with PHP 8 compatibility patches; the XSS vulnerability remains unpatched.

Dockerfile:3-12Dockerfile:20-23

scripts/poc.sh

proof-of-concept exploit script

Bash script that demonstrates the unauthenticated stored XSS by fetching a nonce, injecting a payload, and verifying its storage.

scripts/poc.sh:1-60
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-15041

Supported by supplied evidence

The lab explicitly targets CVE-2016-15041, the Dockerfile installs the vulnerable plugin version, and the PoC script exercises the described unauthenticated stored XSS via the mwp_setup_purchase_username parameter.

README.md:1-3Dockerfile:3-12scripts/poc.sh:1-3scripts/poc.sh:30-35
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:7-9
  • The lab must be started with 'docker compose up -d --build' and allowed ~30 seconds for auto-setup.README.md:7-11
  • The vulnerable endpoint is accessible without authentication at the specified URL.README.md:17-18

Evidence-described exercise path

  1. Start the lab using 'docker compose up -d --build' and wait for the setup banner.README.md:7-11
  2. Access the vulnerable endpoint to obtain a CSRF nonce (no authentication required).scripts/poc.sh:14-22
  3. Inject the XSS payload via a POST request to the same endpoint with the nonce.scripts/poc.sh:24-35
  4. Verify the payload is stored by checking the response, and note that the XSS will execute when an admin views the Extensions page.scripts/poc.sh:37-55
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers: the custom entrypoint only installs WordPress and activates the plugin, the PoC script only targets the local WordPress instance, and no host escape, external connectivity, persistence, or destructive actions are present.

docker-entrypoint-custom.sh:1-58scripts/poc.sh:1-60docker-compose.yml:1-33
Review boundaries

What the analysis did not establish

  • The vulnerable plugin archive (mainwp-3.1.2-vulnerable.zip) is an uninspected binary; its exact contents and any hidden behavior cannot be verified.
  • The Dockerfile downloads wp-cli.phar from an external URL; the downloaded binary is not inspected.
  • The lab relies on an external Nuclei template URL for validation, which is not part of the supplied evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

1