CVE-2019-8979

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-8979 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubelttam/ko7demoRepository PoCby elttam2Not analyzed10 files

7.9 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

elttam/ko7demoCreated Vuln labCVE-2019-8979Compose · mixed

1 Compose manifest · 2 Dockerfiles · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable Kohana (koseven 3.3.9) web application with a MySQL database, and a separate exploit container that executes a blind SQL injection proof-of-concept against the app.

README.adoc:1-3docker-compose.yml:1-27

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'docker-contained koseven hello world to play with CVE-2019-8979, a SQL injection vulnerability'. The compose file defines a vulnerable app, a database, and an exploit service that runs a SQL injection proof-of-concept.

README.adoc:1docker-compose.yml:1-27
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

app

vulnerable web application

Builds a PHP 7.4 Apache container running koseven 3.3.9. The application exposes a /member endpoint that passes unsanitized 'sort' and 'order' query parameters directly to an ORM order_by method, creating a SQL injection vulnerability. The Dockerfile downloads koseven 3.3.9, copies in a vulnerable controller, and configures database credentials.

app/Dockerfile:1-15app/src/application/classes/Controller/Member.php:1-26docker-compose.yml:3-8

db

database server

MySQL 5.7 database initialized with a 'members' table and two sample user records. The database is used by the app service and is exposed on port 3306.

docker-compose.yml:10-17app/initdb.sql:1-11

exploit

proof-of-concept exploit

Builds an Alpine container that clones the albatar SQL injection framework and runs a custom exploit.py script. The script performs a blind SQL injection attack against the app service's /member endpoint to extract database information.

exploit/Dockerfile:1-7exploit/exploit.py:1-36docker-compose.yml:19-22
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-8979

Supported by supplied evidence

The README states the environment is for CVE-2019-8979, a SQL injection in koseven < 3.3.10. The app uses koseven 3.3.9, and the vulnerable Controller_Member passes unsanitized query parameters to order_by, matching the described vulnerability. The exploit script demonstrates blind SQL injection against this endpoint.

README.adoc:1app/Dockerfile:4app/src/application/classes/Controller/Member.php:14-16exploit/exploit.py:1-36
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and docker-compose must be installed on the host.run.sh:3-6
  • The host must be able to pull base images (php:7.4.3-apache, mysql:5.7, alpine:3) and clone remote repositories (koseven, albatar) during build.app/Dockerfile:1-4exploit/Dockerfile:1-3

Evidence-described exercise path

  1. Run docker-compose up -d --build to start the app and db services.run.sh:7
  2. Wait for MySQL to be ready by monitoring logs for 'port: 3306 MySQL Community Server'.run.sh:9-11
  3. Execute the exploit container with docker-compose run --no-deps --rm exploit -b --current-db --current-user --users --dbs to perform blind SQL injection and extract database information.run.sh:14
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the app service). The exploit container only sends HTTP requests to the internal app service and prints extracted data. No host escape, external connectivity, persistence, credential theft, or destructive actions are observed. Port mappings and bind mounts are consistent with a vulnerability lab setup.

exploit/exploit.py:22-24docker-compose.yml:1-27
Review boundaries

What the analysis did not establish

  • The exploit script imports from albatar, which is cloned at build time from an external repository; its full behavior is not inspected.
  • The run.sh script is not executed by the packet analysis; only its static content is considered.
  • The compose file uses a bind mount for the database initialization script, which is a common lab pattern but could be misused in other contexts.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2