## https://sploitus.com/exploit?id=9CEF7320-4DEE-5D43-A7B1-379396FC9CE7
# PHP CVE-2026-17543 Exposure Validator
Safe network-side validator for checking potential exposure to **PHP CVE-2026-17543**.
This project checks whether a remote web server exposes a PHP version affected by CVE-2026-17543 and can optionally perform non-destructive login-form probes using harmless quote/backslash characters.
This is **not an exploit**.
---
## Overview
CVE-2026-17543 affects certain PHP versions where improper escaping of backslashes in attacker-controlled parameters may contribute to SQL injection conditions in affected PostgreSQL-related PHP code paths.
This tool helps defenders validate exposure from the network by:
- Checking HTTP headers for exposed PHP versions.
- Detecting affected PHP versions.
- Optionally submitting safe quote/backslash probes to login forms.
- Looking for visible SQL/PHP error indicators.
---
## Affected Versions
Known affected versions include:
```text
PHP 8.2.x before 8.2.33
PHP 8.3.x before 8.3.30
PHP 8.4.x before 8.4.24
```
---
## Usage
### Version Check Only
```powershell
.\Test-CVE-2026-17543.ps1 -BaseUrl "http://example.local/"
```
### Version Check with Safe Login-Form Probe
```powershell
.\Test-CVE-2026-17543.ps1 `
-BaseUrl "http://example.local/" `
-LoginPath "/login.php" `
-UsernameField "Login[username]" `
-PasswordField "Login[password]" `
-TokenField "Login[token]"
```
---
## Example Output
The following is fake/anonymized sample output.
```text
=== PHP CVE-2026-17543 Exposure Validator ===
Target: http://example.local/
[*] Checking HTTP headers...
[*] Relevant headers:
Server: Apache
X-Powered-By: PHP/8.2.27
[+] Detected PHP version: 8.2.27
[!] Finding: PHP 8.2.27 is below fixed version 8.2.33.
[!] Status: Potentially vulnerable by version exposure.
[*] Starting optional safe login-form probes...
[*] Login URL: http://example.local/login.php
[*] Username field: Login[username]
[*] Password field: Login[password]
[*] Token field: Login[token]
------------------------------
[*] Testing username payload: [testuser]
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.
------------------------------
[*] Testing username payload: [']
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.
Done.
```
## What this tool does not do
This tool does not:
- Bypass authentication.
- Dump database contents.
- Modify database records.
- Use destructive SQL payloads.
- Use `UNION SELECT`, `OR 1=1`, `DROP`, `DELETE`, `UPDATE`, or similar payloads.
- Exploit a target system.