PHP session upload progress RCE exploits (CVE-2026-109618, CVE-2026-109619)

Full RCE exploit chain for two critical PHP vulnerabilities in the multipart parser and session upload progress handler, plus three bypass exploits that defeat the official security patch (PHP 8.4.27) and all recommended mitigations. Core exploits: - CVE-2026-109618: OOM in multipart parser → session persistence → LFI → RCE - CVE-2026-109619: Session poisoning via upload progress (direct + race) → RCE - WordPress-targeted wrapper with LFI auto-detection Patch bypass exploits (confirmed RCE on PHP 8.4.27): - Race condition: TOCTOU inherent to upload progress feature design - RLIMIT_AS: mmap() failure bypasses the patched OOM handler - /proc/PID/fd: temp file inclusion bypasses ALL mitigations
2026-10-21 11:29:40 -05:00
commit e58bb493af
16 changed files with 3113 additions and 0 deletions
@@ -0,0 +1,80 @@
+<?php
+/**
+ * Plugin Name: Developer Toolkit
+ * Description: Development and debugging utilities for WordPress developers.
+ * Version: 2.1.0
+ * Author: DevTools Team
+ * License: GPL-2.0+
+ *
+ * Provides template preview, log viewer, and diagnostic tools for development.
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+    exit;
+}
+
+// Register admin page
+add_action( 'admin_menu', function() {
+    add_management_page(
+        'Developer Toolkit',
+        'Dev Toolkit',
+        'manage_options',
+        'dev-toolkit',
+        'devtoolkit_admin_page'
+    );
+});
+
+// Template preview (simulates common theme/template preview plugins)
+add_action( 'template_redirect', function() {
+    if ( isset( $_GET['dt_preview'] ) && current_user_can( 'edit_themes' ) ) {
+        $template = sanitize_text_field( $_GET['dt_preview'] );
+        if ( file_exists( $template ) ) {
+            include $template;
+            exit;
+        }
+    }
+});
+
+// AJAX log viewer endpoint (common in debug/logging plugins)
+add_action( 'wp_ajax_dt_view_log', function() {
+    if ( ! current_user_can( 'manage_options' ) ) {
+        wp_die( 'Unauthorized' );
+    }
+    $logfile = isset( $_GET['file'] ) ? $_GET['file'] : '';
+    if ( $logfile && is_readable( $logfile ) ) {
+        header( 'Content-Type: text/plain' );
+        readfile( $logfile );
+        exit;
+    }
+    wp_die( 'File not found' );
+});
+
+// Front-end template include (no auth required - simulates broken plugin)
+add_action( 'init', function() {
+    if ( isset( $_GET['dt_template'] ) ) {
+        $tpl = $_GET['dt_template'];
+        // "Sanitization" that doesn't prevent path traversal
+        $tpl = str_replace( "\0", '', $tpl );
+        if ( file_exists( $tpl ) ) {
+            include $tpl;
+            exit;
+        }
+    }
+});
+
+// Session-based features (simulates WooCommerce/forms using sessions)
+add_action( 'init', function() {
+    if ( ! session_id() ) {
+        session_start();
+    }
+});
+
+function devtoolkit_admin_page() {
+    echo '<div class="wrap"><h1>Developer Toolkit</h1>';
+    echo '<p>Development utilities for debugging and testing.</p>';
+    echo '<h2>PHP Info</h2>';
+    echo '<p>Session ID: ' . session_id() . '</p>';
+    echo '<p>Session Save Path: ' . session_save_path() . '</p>';
+    echo '<p>Upload Progress: ' . ini_get('session.upload_progress.enabled') . '</p>';
+    echo '</div>';
+}