I have working RCE as long as the server has a memory_limit that is less than the max POST size. From my reading of the PHP patch, there's no way around that part, but a lot of real sites are running like this.
No idea of course if this meets the authors' "out of the box" condition. Who runs a fully stock PHP config?
No idea of course if this meets the authors' "out of the box" condition. Who runs a fully stock PHP config?