Collected research

PHP Development Server <= 7.4.21 - Remote Source Disclosure

Shows how HTTP request pipelining can leave stale request-path state in PHP's built-in development server. A second request is then handled with mismatched path and extension data, causing PHP source files to be returned as static content.

Record

Published by

ProjectDiscovery

In the archive

• Collected in the 2023 research round

Tags

• http
• parser-differential
• info-leak
• php

This page is the archive's own catalogue record. The research is the work of ProjectDiscovery, first published at the original source. Preserved copies are kept so the citation survives its host.