Let’s consider the following code inserted at the top of a legitimate php file:
It’s not simple to understand how to exploit the above code, if the malware authors set the callback function to be the variable “login” is is able to execute arbitrary code.
As shown in the below example the attacker could execute a system command with this trick avoiding any detection from defensive application.
Coding best practices suggest to carefully inspect the source code to find PHP functions like the ones discussed, but the post presented a technique that allows attackers to run arbitrary code silently.
“Also, note that they are not just restricted to the array_diff_ukey() function, but any other function that allows for callbacks.” states the post.
(Security Affairs – PHP, Backdoor)