CVE-2023-39539

HIGH

Failure when uploading a Logo image file

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-39539 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

AptioV

Browse AMI / AptioV

Default status: unaffected

CVE ListBKS_5.0 to < BKS_5.34affected

Proofs of concept

1

Repository PoCs

GitHubAdamWen230/CVE-2023-39539-PoCRepository PoCby AdamWen2301Not analyzed4 files

4.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

AdamWen230/CVE-2023-39539-PoCCreated Vuln labCVE-2023-39539Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a Cacti 1.2.22 web application with a MySQL 5.7 database, intended as a target for CVE-2023-39539 exploitation.

docker-compose.yml:1-21README.md:1-2

Lab assessment

Vulnerability lab

The README explicitly states 'PoC for CVE-2023-39539 in Cacti 1.2.22', and the Docker Compose file sets up a Cacti 1.2.22 service, matching the described target. The included Python script (poc.py) is a proof-of-concept exploit for this CVE.

README.md:1-2docker-compose.yml:4poc.py:1-89
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable target application

Runs Cacti 1.2.22 from the vulhub/cacti:1.2.22 image, exposed on host port 8080. Uses a custom entrypoint script to initialize the database and start Apache.

docker-compose.yml:3-15entrypoint.sh:1-20

db

database backend

MySQL 5.7 database service with root password 'root' and a database named 'cacti', used by the Cacti application.

docker-compose.yml:16-21

entrypoint.sh

database initializationservice startup

A bash script mounted into the web container. It installs python3, waits for the database, imports cacti.sql if needed, sets admin password change flag, sets timezone, and then executes the provided command (apache2-foreground).

entrypoint.sh:1-20

poc.py

exploit script

A Python script that authenticates to the Cacti web interface, exploits an SQL injection in graphs.php to update the path_php_binary setting with a reverse shell command, triggers the reverse shell via host.php, and then attempts to restore the original setting.

poc.py:1-89
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-39539

Supported by supplied evidence

The README and the exploit script both target CVE-2023-39539. The script exploits an authenticated SQL injection in graphs.php 'site_id' parameter of Cacti 1.2.22, which matches the CVE description.

README.md:1-2poc.py:1-89
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.docker-compose.yml:1
  • Valid Cacti credentials (username and password) for the target instance.poc.py:67-68
  • A listener on the attacker's machine to receive the reverse shell (lhost and lport).poc.py:69-70

Evidence-described exercise path

  1. Start the lab environment using docker-compose up.docker-compose.yml:1-21
  2. Run the exploit script poc.py with target URL, credentials, and attacker listener details.poc.py:66-70
  3. The script logs in, sends the SQL injection payload to update the PHP binary path to a reverse shell command, triggers the shell, and attempts to restore the setting.poc.py:30-65
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets the lab's own Cacti container and opens a reverse shell to an operator-specified listener. This is expected behavior for a vulnerability lab. No evidence of host compromise, persistence, data destruction, or actions against unrelated systems is present.

poc.py:30-65
Review boundaries

What the analysis did not establish

  • The packet does not include the Cacti application source code or the cacti.sql file, so the exact vulnerable code path cannot be verified.
  • The vulhub/cacti:1.2.22 image is not inspected; its contents are unknown beyond the Dockerfile and entrypoint behavior.
  • The exploit script's recover_payload may not fully restore the original setting, but this is a limitation of the PoC, not a malicious indicator.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4