88
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
submitted 3 days ago* (last edited 3 days ago) by INeedMana@piefed.zip to c/selfhosted@lemmy.world
31 comments fedilink hide all child comments

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

you are viewing a single comment's thread
view the rest of the comments
[-] INeedMana@piefed.zip -1 points 2 days ago

Yes, but from the page I linked

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

For sure that this is still a bug that should be patched. But I do remember "don't eval on user sent stuff" rule. Or is this really prevalent in PHP ecosystem?

[-] realitaetsverlust@piefed.zip 6 points 2 days ago

Or is this really prevalent in PHP ecosystem?

Not anymore.

You used to see eval a TON in like the early days, with like PHP 4 and 5. People just weren't very experienced and PHP in itself had it's limitations, and people worked around those by utilizing eval.

But modern PHP code rarely ever uses eval. Modern toolings like PHPMD even flag eval as an error, causing it to fail a pipeline if used in one. If you find eval in a codebase today, it's either a badly modernized legacy one or written by a retard.

[-] phoenixz@lemmy.ca 1 points 1 day ago

Dont use eval, period

If you use eval, you're doing it wrong

[-] INeedMana@piefed.zip 2 points 1 day ago

That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval

[-] i_am_not_a_robot@discuss.tchncs.de 6 points 2 days ago

Those PoCs are fake. You can exploit a page that just prints "hello."

this post was submitted on 22 Oct 2026
88 points (88.6% liked)

Selfhosted

63189 readers
376 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world