PHP CVE-2026-17543 Exposure Validator

Safe network-side validator for checking potential exposure to PHP CVE-2026-17543.

This project checks whether a remote web server exposes a PHP version affected by CVE-2026-17543 and can optionally perform non-destructive login-form probes using harmless quote/backslash characters.

This is not an exploit.

Overview

CVE-2026-17543 affects certain PHP versions where improper escaping of backslashes in attacker-controlled parameters may contribute to SQL injection conditions in affected PostgreSQL-related PHP code paths.

This tool helps defenders validate exposure from the network by:

Checking HTTP headers for exposed PHP versions.
Detecting affected PHP versions.
Optionally submitting safe quote/backslash probes to login forms.
Looking for visible SQL/PHP error indicators.

Affected Versions

Known affected versions include:

PHP 8.2.x before 8.2.33
PHP 8.3.x before 8.3.30
PHP 8.4.x before 8.4.24

Usage

Version Check Only

.\Test-CVE-2026-17543.ps1 -BaseUrl "http://example.local/"

.\Test-CVE-2026-17543.ps1 `
  -BaseUrl "http://example.local/" `
  -LoginPath "/login.php" `
  -UsernameField "Login[username]" `
  -PasswordField "Login[password]" `
  -TokenField "Login[token]"

Example Output

The following is fake/anonymized sample output.

=== PHP CVE-2026-17543 Exposure Validator ===
Target: http://example.local/

[*] Checking HTTP headers...

[*] Relevant headers:
    Server: Apache
    X-Powered-By: PHP/8.2.27

[+] Detected PHP version: 8.2.27
[!] Finding: PHP 8.2.27 is below fixed version 8.2.33.
[!] Status: Potentially vulnerable by version exposure.

[*] Starting optional safe login-form probes...
[*] Login URL: http://example.local/login.php
[*] Username field: Login[username]
[*] Password field: Login[password]
[*] Token field: Login[token]

------------------------------
[*] Testing username payload: [testuser]
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.

------------------------------
[*] Testing username payload: [']
[*] Token extracted: abc123...def456
[*] HTTP Status: 200
[*] Response Length: 5970
[+] No visible SQL/PHP error indicators found.

Done.

What this tool does not do

This tool does not:

Bypass authentication.
Dump database contents.
Modify database records.
Use destructive SQL payloads.
Use UNION SELECT, OR 1=1, DROP, DELETE, UPDATE, or similar payloads.
Exploit a target system.

Most Popular

CVE-2026-17543-PHP-Exposure-Validator