CVE-2019-13956

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-13956 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubrhbb/CVE-2019-13956Repository PoCby rhbb0Not analyzed2 files

410 B

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

rhbb/CVE-2019-13956Created Vuln labCVE-2019-13956Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for CVE-2019-13956, consisting of a web service using the boyhack/discuz_ml image and a MySQL 5.7.22 database service.

README.md:1-4docker-compose.yml:1-19

Lab assessment

Vulnerability lab

The README explicitly references CVE-2019-13956 and provides commands to start the environment, indicating it is a vulnerability lab for that CVE.

README.md:1-4
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable web application

Uses the boyhack/discuz_ml image, likely a Discuz! ML application, with environment variables suggesting a connection to a MySQL database. Port 80 is exposed on host port 8090.

docker-compose.yml:3-13

mysql

database server

Uses the mysql:5.7.22 image with root password set to 'root'. No ports are exposed to the host.

docker-compose.yml:14-19
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-13956

Insufficient evidence

The README associates the lab with CVE-2019-13956, but no exploit code, vulnerable version details, or vulnerability description is provided in the evidence to confirm the association.

README.md:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed.README.md:3

Evidence-described exercise path

  1. Change directory to the lab folder.README.md:2
  2. Start the environment with docker-compose up -d.README.md:3
  3. Access the web application at http://127.0.0.1:8090.README.md:4
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment only exposes a web service on localhost port 8090 and a database with no host ports. No privileged mode, host volume mounts, or external network connections are configured. The behavior is consistent with a contained vulnerability lab.

docker-compose.yml:1-19
Review boundaries

What the analysis did not establish

  • The boyhack/discuz_ml image is a binary artifact and its contents are uninspected.
  • No exploit code or vulnerability details are provided to verify the CVE association.
  • The Compose file uses environment variables prefixed with JOOMLA_ for a Discuz! application, which may be a misconfiguration but its impact is unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2