PHP 8.2.x before 8.2.33
PHP 8.3.x before 8.3.30
PHP 8.4.x before 8.4.24

.\Test-CVE-2026-17543.ps1 -BaseUrl "http://example.local/"

.\Test-CVE-2026-17543.ps1 `
  -BaseUrl "http://example.local/" `
  -LoginPath "/login.php" `
  -UsernameField "Login[username]" `
  -PasswordField "Login[password]" `
  -TokenField "Login[token]"

=== PHP CVE-2026-17543 Exposure Validator ===
Target: http://example.local/

[*] Checking HTTP headers...

[*] Relevant headers:
    Server: Apache
    X-Powered-By: PHP/8.2.27

[+] Detected PHP version: 8.2.27
[!] Finding: PHP 8.2.27 is below fixed version 8.2.33.
[!] Status: Potentially vulnerable by version exposure.

[*] Starting optional safe login-form probes...
[*] Login URL: http://example.local/login.php
[*] Username field: Login[username]
[*] Password field: Login[password]
[*] Token field: Login[token]

------------------------------
[*] Testing username payload: [testuser]
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.

------------------------------
[*] Testing username payload: [']
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.

Done.