Bug #76666 [Opn->Nab]: create_function code evasion

Edit report at https://bugs.php.net/bug.php?id=76666&edit=1 ID: 76666 Updated by: requinix@php.net Reported by: i at sym01 dot com Summary: create_function code evasion -Status: Open +Status: Not a bug Type: Bug Package: *General Issues Operating System: * PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php http://php.net/manual/en/function.create-function.php > Caution > This function internally performs an eval() and as such has the same security issues as eval(). > Additionally it > has bad performance and memory usage characteristics. > If you are using PHP 5.3.0 or newer a native anonymous function should be used instead. Previous Comments: ------------------------------------------------------------------------ [2018-07-26 04:01:24] i at sym01 dot com Description: ------------ create_function can execute PHP code directly, which may cause some security problems. Test script: --------------- <?php echo "result: "; $payload1 = <<<EOF echo 'normal'; EOF; create_function('', $payload1); $payload2 = <<<EOF } echo '[VULN]';// EOF; create_function('', $payload2); Expected result: ---------------- result: Actual result: -------------- result: [VULN] ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76666&edit=1