CVE-2023-30212

MEDIUM NUCLEI

ourphp <= 7.2.0 - Cross-Site Scripting via /client/manage/ourphp_out.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 15 public exploits for CVE-2023-30212. PoCs published by libasmon, VisDev23, kuttappu123. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository provides a Docker environment and exploit for CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0. The exploit demonstrates a reflected XSS attack via the `/client/manage/ourphp_out.php` endpoint.

Description

OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

Exploits (15)

nomisec WORKING POC 3 stars
by libasmon · poc
https://github.com/libasmon/Exploite-CVE-2023-30212-Vulnerability

This repository provides a Docker environment and exploit for CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0. The exploit demonstrates a reflected XSS attack via the `/client/manage/ourphp_out.php` endpoint.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OURPHP <= 7.2.0
No auth needed
Prerequisites: Docker installed · OURPHP <= 7.2.0 deployed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by VisDev23 · poc
https://github.com/VisDev23/Vulnerable-Docker--CVE-2023-30212-

This repository provides a Docker environment to replicate CVE-2023-30212, an XSS vulnerability in OURPHP. The PoC includes a Dockerfile and vulnerable application files, along with a payload to trigger the XSS.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OURPHP (version not specified)
Auth required
Prerequisites: Docker installed · OURPHP configured with default credentials (root/root)
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by kuttappu123 · poc
https://github.com/kuttappu123/CVE-2023-30212-LAB

This repository provides a Docker-based lab environment to demonstrate CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0 via the `/client/manage/ourphp_out.php` endpoint. The PoC includes setup instructions and a sample exploit URL.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OURPHP <= 7.2.0
No auth needed
Prerequisites: Docker installed · OURPHP <= 7.2.0 setup
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Rishipatidar · poc
https://github.com/Rishipatidar/CVE-2023-30212-POC-DOCKER-FILE

This repository provides a proof-of-concept for CVE-2023-30212, an XSS vulnerability in ourphp 7.2.0 via the /client/manage/ourphp_out.php endpoint. The exploit leverages the 'out' parameter to inject malicious JavaScript when the 'ourphp_admin' parameter is set to 'logout'.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: ourphp 7.2.0
No auth needed
Prerequisites: Access to the vulnerable endpoint · Docker setup for testing
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by sungmin20 · poc
https://github.com/sungmin20/cve-2023-30212

This repository provides a Docker-based PoC for CVE-2023-30212, demonstrating a Local File Inclusion (LFI) vulnerability in PHP that can lead to Remote Code Execution (RCE). The exploit uses `php://filter` to read and execute a malicious PHP file, creating a file in `/tmp` as proof of execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHP (version not specified, likely affected versions)
No auth needed
Prerequisites: Docker environment · PHP 8.1-apache base image · Access to the vulnerable PHP endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by AAsh035 · poc
https://github.com/AAsh035/CVE-2023-30212

This repository provides a lab setup for CVE-2023-30212, an XSS vulnerability in OurPHP. It includes a Docker environment and a proof-of-concept exploit demonstrating the vulnerability via a crafted URL.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OurPHP CMS
No auth needed
Prerequisites: Docker installed · OurPHP CMS setup
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by arunsnap · poc
https://github.com/arunsnap/CVE-2023-30212-POC

This repository provides a writeup and steps to reproduce a reflected XSS vulnerability in Ourphp version 7.2.0 via the 'out' parameter in the logout functionality. It includes Docker setup instructions and a proof-of-concept payload.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Ourphp 7.2.0
No auth needed
Prerequisites: Docker · Ourphp 7.2.0 installed · Access to the vulnerable endpoint
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by JasaluRah · poc
https://github.com/JasaluRah/Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-

This repository provides a Docker environment to replicate CVE-2023-30212, an XSS vulnerability in OurPHP. The PoC demonstrates the vulnerability via a crafted URL that triggers a JavaScript alert.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OurPHP CMS
No auth needed
Prerequisites: Docker environment · OurPHP CMS installed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by imathewvincent · poc
https://github.com/imathewvincent/CVE-2023-30212-OURPHP-Vulnerability

This repository provides a detailed technical walkthrough for replicating CVE-2023-30212, an XSS vulnerability in OURPHP versions up to 7.2.0. It includes step-by-step setup instructions, a proof-of-concept payload, and references to external resources.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: OURPHP <= 7.2.0
Auth required
Prerequisites: Docker environment · OURPHP installation · Admin credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by kai-iszz · poc
https://github.com/kai-iszz/CVE-2023-30212

This repository provides a writeup for exploiting CVE-2023-30212, an XSS vulnerability in Ourphp 7.2.0. It includes setup instructions and a proof-of-concept payload for triggering the vulnerability.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Ourphp 7.2.0
No auth needed
Prerequisites: Docker · Ourphp 7.2.0 installed · XAMPP server
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by libasv · poc
https://github.com/libasv/Exploite-CVE-2023-30212-vulnerability

This repository provides a Docker-based vulnerable environment and a proof-of-concept exploit for CVE-2023-30212, an XSS vulnerability in OURPHP <= 7.2.0. The exploit demonstrates the vulnerability via a crafted URL targeting the `/client/manage/ourphp_out.php` endpoint.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OURPHP <= 7.2.0
No auth needed
Prerequisites: Docker installed · OURPHP <= 7.2.0 deployed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by mallutrojan · poc
https://github.com/mallutrojan/CVE-2023-30212-Lab

This repository provides a Docker-based lab environment to test CVE-2023-30212, an XSS vulnerability in OurPHP. The lab.sh script automates the setup of a vulnerable environment, including downloading and configuring the target software.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OurPHP (version not specified)
No auth needed
Prerequisites: Docker installed · Internet access to download files
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by libas7994 · poc
https://github.com/libas7994/CVE-2023-30212

This repository contains a README describing CVE-2023-30212, an XSS vulnerability in OURPHP versions up to 7.2.0. No exploit code or Docker environment details are provided in the snippet.

Classification
Writeup 80%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: OURPHP <= 7.2.0
No auth needed
Prerequisites: Access to a vulnerable OURPHP instance
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by Anandhu990 · poc
https://github.com/Anandhu990/CVE-2023-30212_lab

The repository contains only a README.md file with minimal content, lacking any exploit code or technical details for CVE-2023-30212.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

OURPHP <= 7.2.0 - Cross Site Scripting
MEDIUMVERIFIEDby theamanrawat

Scores

CVSS v3 6.1
EPSS 0.0811
EPSS Percentile 94.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
ourphp/ourphp < 7.2.0
Published Apr 26, 2023
Tracked Since Feb 18, 2026