CVE-2023-30212

CVE-2023-30212

Supported by supplied evidence

The README describes the environment as a PoC for CVE-2023-30212, and the provided vulnerable.php and malicious.php demonstrate a PHP LFI leading to remote code execution, consistent with the CVE description.

Prerequisites

• Docker and Docker Compose must be installed to build and run the environment.README.md:37-39
• The container must be running and accessible on localhost port 8088.docker-compose.yaml:5README.md:43

Evidence-described exercise path

1. Start the container with 'docker-compose up -d'.README.md:37-39
2. Use the LFI vulnerability to read malicious.php source via php://filter.README.md:47-51
3. Execute malicious.php directly to run the system command.README.md:59-61
4. Verify command execution by checking for /tmp/pwned inside the container.README.md:63-67

No harmful behavior observed

All visible behavior is confined to the lab container. The malicious.php payload only creates a file inside the container's /tmp, and there are no host volume mounts, privileged mode, or network connections to external systems. The exercise demonstrates the vulnerability without escaping the lab boundary.

CVE-2023-30212

Insufficient evidence

The README claims the environment is susceptible to CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0 via /client/manage/ourphp_out.php. However, the supplied evidence does not include the actual application source code (e.g., ourphp_out.php) or any runtime demonstration of the vulnerability. The Dockerfile only sets up the infrastructure; the vulnerability cannot be confirmed from the provided artifacts.

Prerequisites

• Docker must be installed on the host to build and run the container.README.md:13-17
• The Dockerfile and application files must be present in the build context.README.md:9-11
• The container must be run with port mapping (e.g., -p 8080:80) to access the web server.README.md:27-29

Evidence-described exercise path

1. Build the Docker image using 'docker build -t test .'README.md:23-25
2. Run the container with port mapping: 'docker run -d -p 8080:80 test'README.md:27-29
3. Optionally, exec into the container to configure MySQL privileges (though not strictly required for the XSS exploit).README.md:37-75
4. Trigger the XSS vulnerability by visiting 'http://localhost:8080/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert(xss)</script>'README.md:79

No harmful behavior observed

The Dockerfile and README describe a self-contained lab environment. The container runs Apache and MySQL internally, exposes only port 80, and does not mount host directories, run in privileged mode, or connect to external networks beyond the base image pull. The exploit URL targets the local container's web application. No hidden, destructive, or host-escaping behavior is evident.

CVE-2023-30212

Insufficient evidence

The README claims the environment is susceptible to CVE-2023-30212 and provides an exploit URL. However, the actual application source code (e.g., ourphp_out.php) is not included in the evidence files, so the presence of the vulnerable code cannot be verified.

Prerequisites

• Docker must be installed on the host to build and run the image.README.md:11-15
• The local 'file' directory containing the OURPHP application must be present in the build context.dockerfile:37

Evidence-described exercise path

1. Build the Docker image using 'docker build -t test .'README.md:21-23
2. Run the container with port mapping: 'docker run -d -p 8080:80 test'README.md:27-29
3. Access the vulnerable URL: http://localhost:8080/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert(`xss`)</script>README.md:75

No harmful behavior observed

The Dockerfile and README describe a self-contained lab environment. The only network exposure is port 80 mapped to the host, which is typical for a web-based vulnerability lab. No hidden or unnecessary host compromise, persistence, credential theft, or external connections are indicated.