References https://github.com/vulhub/vulhub/blob/master/php/xdebug-rce/README.md https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/language/PHP-XDebug-%E8%BF%9C%E7%A8%8B%E8%B0%83%E8%AF%95%E6%A8%A1%E5%BC%8F%E5%AF%BC%E8%87%B4%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C.md http://joker-vip.github.io/2021/12/06/XDebug%20%E8%BF%9C%E7%A8%8B%E8%B0%83%E8%AF%95%E6%BC%8F%E6%B4%9E%EF%BC%88%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%EF%BC%89/ https://www.cnblogs.com/justdoIT20680/p/18852061 https://xlab.tencent.com/cn/2018/03/30/pwn-local-xdebug/ https://blog.csdn.net/qq_43645782/article/details/107040426 https://blog.spoock.com/2017/09/19/xdebug-attack-surface/ https://nvd.nist.gov/vuln/detail/CVE-2015-10141 https://www.tenable.com/plugins/nessus/112210 https://www.exploit-db.com/exploits/44568 https://www.rapid7.com/db/modules/exploit/unix/http/xdebug_unauth_exec/ https://support.alertlogic.com/hc/en-us/articles/360018777372-Web-Server-XDebug-remote-connect-back-RCE https://www.acunetix.com/vulnerabilities/web/xdebug-remote-code-execution-via-xdebug-remote_connect_back/
Related VulnerabilitiesPoCCVE-2015-10141: Xdebug <= 2.5.5 - Command Injection(CVE-2015-10141)Xdebug远程未认证命令注入漏洞