Yeah, the specific setup is not vulnerable to PHP2SHELL. CLI server + 1 MiB cap + inert page + high memory limit removes all the possibilities from the two CVEs. It would just be collecting POCs for actually vulnerable setups.

▲

gr_norm 2 hours ago | parent | next [-]

I'm just an interested bystander, but this seems like a (near?) default nginx config. Is that accurate?

	▲	randomblock1 an hour ago \| parent [-]
		Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your way. So it's not a good representation of a PHP application, but for other uses it's reasonable.

▲

tclancy 2 hours ago | parent | prev [-]

Should be the top comment IMO.