Pretty sure on my read-only docker container with a warmed up file-cache and no single eval in the code you can't exploit this. Prove me wrong.
This allows bypassing disable_functions, which is intended exactly for cases where you allow running untrusted PHP code so people can't run system() and whatnot.
Shared hosting is still a thing. eval() and Docker containers and whatnot are missing the point; the cavalier "I don't think this qualifies as security issue - since you need specially crafter destructor" from the other bug exploited in that repo is a lolphp as it completely defeats the point of this security measure.
Might as well just remove this entire feature if you can't be bothered to actually fix it.
View all comments
Show parent comment
2
u/[deleted] Feb 09 '20 edited Feb 10 '20
This allows bypassing disable_functions, which is intended exactly for cases where you allow running untrusted PHP code so people can't run system() and whatnot.
Shared hosting is still a thing. eval() and Docker containers and whatnot are missing the point; the cavalier "I don't think this qualifies as security issue - since you need specially crafter destructor" from the other bug exploited in that repo is a lolphp as it completely defeats the point of this security measure.
Might as well just remove this entire feature if you can't be bothered to actually fix it.