why we can't use additional_parameters in safe_mode? about exploit-cve-2016-10033 HOT 7 CLOSED

Can you elaborate ? I didn't understand your point.

from exploit-cve-2016-10033.

in readme.md you said that "Then, the code flow goes to mailPassthru() function, which, if running in safe_mode won't be vulnerable to this flaw, as the following code states it"

Why?

from exploit-cve-2016-10033.

because of this line

if (ini_get('safe_mode') or !$this->UseSendmailOptions or is_null($params)) {

from exploit-cve-2016-10033.

but !$this->UseSendmailOptions is alway TRUE so when safe_mode FALSE, this line still happened

from exploit-cve-2016-10033.

!$this->UseSendmailOptions

is false in this scenario, look closer, there is a ! in the front of the variable.

from exploit-cve-2016-10033.

oh! sorry ! I got it. thank you!

from exploit-cve-2016-10033.

No problem ! For any further investigation, if you need, you can just use error_log("string"); , regenerate the imagem and run the exploit against it. So you will be able to see the execution flow.

from exploit-cve-2016-10033.