rishipatidar/cve-2023-30212-poc-docker-file
Este repositorio proporciona un contenedor Docker para simular la vulnerabilidad CVE-2023-30212, lo que le permite practicar y comprender su impacto. Incluye una guía completa para ayudarle a configurar el contenedor en su propio equipo. También se incluye la documentación del proceso de creación de Docker.
| Vendedor | Producto | Versión |
|---|
| ourphp | ourphp | 7.2.0 |
Para instalar OURPHP <= 7.2.0 en docker puedes usar guía para instalar docker con fines de práctica.
# ourphp 7.2.0 version has a vulnerability to XSS (Cross-Site Scripting).
# In the file /client/manage/ourphp_out.php, there is a direct echo functionality that, along with controllable variables, can enable attackers to execute XSS code.When the ourphp_admin parameter is set to "logout," we echo a controllable variable called "out."
# To exploit this, we prepend a script tag and close it, forming our payload.This vulnerability can be exploited through the "out" parameter by injecting the following script: "</script><script>alert(xss)</script>"
# After completing the setup of the docker directly. Access the following path :
http://localhost/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert(`xss`)</script>
# </script><script>alert(`xss`)</script>
