ROOTPLOIT
Server: LiteSpeed
System: Linux in-mum-web1878.main-hosting.eu 5.14.0-570.21.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 11 07:22:35 EDT 2025 x86_64
User: u435929562 (435929562)
PHP: 7.4.33
Disabled: system, exec, shell_exec, passthru, mysql_list_dbs, ini_alter, dl, symlink, link, chgrp, leak, popen, apache_child_terminate, virtual, mb_send_mail
Upload Files
File: //opt/cloudlinux/alt-php53/root/usr/share/xcache_3/cacher/edit.php
<?php

include "./common.php";

if (!isset($_GET['name'])) {
	die("missing name");
}

// trigger auth
$vcnt = xcache_count(XC_TYPE_VAR);
xcache_admin_namespace();

$name = $_GET['name'];
if (!empty($config['enable_eval'])) {
	eval('$name = ' . $name . ';');
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
	if (!empty($config['enable_eval'])) {
		eval('$value = ' . $_POST['value'] . ';');
	}
	else {
		$value = $_POST['value'];
	}
	xcache_set($name, $value);
	header("Location: ./?do=listvar");
	exit;
}
$value = xcache_get($name);
if (!empty($config['enable_eval'])) {
	$value = var_export($value, true);
	$editable = true;
}
else {
	if (is_string($value)) {
		$editable = true;
	}
	else {
		$editable = false;
		$value = var_export($value, true);
	}
}

include "edit.tpl.php";

?>