Assert is the new sexy about drupalgeddon2 HOT 5 CLOSED

Indeed, with assert you can create an uploader and then use Chankro (https://github.com/TarlogicSecurity/Chankro) to bypass disable_functions & open_basedir.

from drupalgeddon2.

In progress... by the way, you can use "do-not-use.rb" and use whatever php method you want:

ruby do-not-use.rb https://localhost 7 command phpmethod
ruby do-not-use.rb https://localhost 8 command phpmethod

Good luck!

from drupalgeddon2.

Investigating why this only works on some specific cases.

from drupalgeddon2.

Tonight I am going to try to triage the issue.

My environment is:
PHP Version 7.0.27-0 Debian 4.9.82-1+deb9u3
Drupal version 7.57

from drupalgeddon2.

In a PHP 7 installed by default it works (Drupal 7.57):
sudo apt-get install libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-mysql

But it does not work with PHP 5.

from drupalgeddon2.