Hi, you haven't looked at the code in your exploit.
Take a look at the php files you're shipping with your "stock" server - theyre pretty contrived, no? fatal.php? producer.php boom() str repeat X 32?
You use that to get the constants for the RCE, but without that information you're in trouble. How transferrable are these constants? Do they work with any config changes?
Again, the vuln is real and you should patch, but an exploit is not easy; this is not log4shell/heartbleed etc.
Take a look at the php files you're shipping with your "stock" server - theyre pretty contrived, no? fatal.php? producer.php boom() str repeat X 32?
You use that to get the constants for the RCE, but without that information you're in trouble. How transferrable are these constants? Do they work with any config changes?
Again, the vuln is real and you should patch, but an exploit is not easy; this is not log4shell/heartbleed etc.