Comment by dawnerd
1 day ago
Used this as a base: https://jackalsyn.com/posts/php-up-2026.html
But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.
They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?
I ran the PoC on my dev environment, the PoC is not complete and does not work.
I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware...
If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more.
A 9-figure business with PHP is mind-boggling.
6 replies →
then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.
I tried it too in a clean Debian Trixie container and got no crash.
This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised?
I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident?
1 reply →
On which OS and Server did you run the exploit against?