403WebShell

????JFIF??x?x????'403WebShell403Webshell

Server IP : 79.136.114.73 / Your IP : 216.73.216.37
Web Server : Apache/2.4.7 (Ubuntu) PHP/5.5.9-1ubuntu4.29 OpenSSL/1.0.1f
System : Linux b8009 3.13.0-170-generic #220-Ubuntu SMP Thu May 9 12:40:49 UTC 2019 x86_64
User : www-data ( 33)
PHP Version : 5.5.9-1ubuntu4.29
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,
MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /proc/self/root/home/b8009/php-5.6.22/Zend/tests/

Upload File :

[ Back ]

Current File : /proc/self/root/home/b8009/php-5.6.22/Zend/tests/bug40833.phpt

--TEST--
Bug #40833 (Crash when using unset() on an ArrayAccess object retrieved via __get) 
--FILE--
<?php
	class entity
	{
		private $data;
		private $modified;

		function __get($name)
		{
			if ( isset($this->data[$name]) )
				return $this->data[$name];
			else
				return $this->data[$name] = new set($this);
		}

		function __set($name, $value)
		{
			$this->modified[$name] = $value;
		}
	}

	class set implements ArrayAccess
	{
		private $entity;

		function __construct($entity)
		{
			$this->entity = $entity;
			$this->entity->whatever = $this;
		}

		function clear() {
			$this->entity->whatever = null;
		}

		function offsetUnset($offset)
		{
			$this->clear();
//			$this->entity->{$this->name} = null;
		}

		function offsetSet($offset, $value)
		{
		}

		function offsetGet($offset)
		{
			return 'Bogus ';
		}

		function offsetExists($offset)
		{
		}
	}

	$entity = new entity();
	echo($entity->whatever[0]);

	//This will crash
//	$entity->whatever->clear();
	unset($entity->whatever[0]);

	//This will not crash (comment previous & uncomment this to test
//	$test = $entity->whatever; unset($test[0]);

	echo($entity->whatever[0]);
	echo "ok\n";
?>
--EXPECT--
Bogus Bogus ok

Youez - 2016 - github.com/yon3zu
LinuXploit