Online PHP editor | output for 4oslP

@ 2020-11-23T13:50:06Z

<?php

$testData = [
    // this is the demo email used in the proof of concept of the exploit
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
    // trying more adresses
    '"Attacker -Param2 -Param3"@test.com',
    '\'Attacker -Param2 -Param3\'@test.com',
    '"Attacker \" -Param2 -Param3"@test.com',
    "'Attacker \\' -Param2 -Param3'@test.com",
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
    // and even more variants
    '"attacker\"\ -oQ/tmp/\ -X/var/www/cache/phpcode.php"@email.com',
    "\"attacker\\\"\0-oQ/tmp/\0-X/var/www/cache/phpcode.php\"@email.com",
    '"attacker@cebe.cc\"-Xbeep"@email.com',

    "'attacker\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\\\'\\ -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\';touch /tmp/hackme'@email.com",
    "'attacker\\\\';touch /tmp/hackme'@email.com",
    "'attacker\\';touch/tmp/hackme'@email.com",
    "'attacker\\\\';touch/tmp/hackme'@email.com",
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
];

foreach ($testData as $email) {
   echo "$email: " . (filter_var($email, FILTER_VALIDATE_EMAIL) ? 'Valid' : 'Invalid') . "\n";    
}

Output for 7.0.10, 7.2.0 - 7.2.34, 7.3.0 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.34, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.1 - 8.4.14, 8.4.16 - 8.4.17, 8.5.0 - 8.5.2: "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid "Attacker -Param2 -Param3"@test.com: Invalid 'Attacker -Param2 -Param3'@test.com: Invalid "Attacker \" -Param2 -Param3"@test.com: Invalid 'Attacker \' -Param2 -Param3'@test.com: Invalid "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid "attacker\"\ -oQ/tmp/\ -X/var/www/cache/phpcode.php"@email.com: Valid "attacker\"-oQ/tmp/-X/var/www/cache/phpcode.php"@email.com: Invalid "attacker@cebe.cc\"-Xbeep"@email.com: Valid 'attacker\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\\'\ -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\';touch /tmp/hackme'@email.com: Invalid 'attacker\\';touch /tmp/hackme'@email.com: Invalid 'attacker\';touch/tmp/hackme'@email.com: Invalid 'attacker\\';touch/tmp/hackme'@email.com: Invalid "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid
Output for 8.4.15: /bin/php-8.4.15: /usr/lib/libm.so.6: version `GLIBC_2.38' not found (required by /bin/php-8.4.15) /bin/php-8.4.15: /usr/lib/libm.so.6: version `GLIBC_2.35' not found (required by /bin/php-8.4.15) /bin/php-8.4.15: /usr/lib/libc.so.6: version `GLIBC_2.34' not found (required by /bin/php-8.4.15) /bin/php-8.4.15: /usr/lib/libc.so.6: version `GLIBC_2.38' not found (required by /bin/php-8.4.15)
Process exited with code 1.

preferences:dark modelive previewkey bindings