Detects case-sensitivity bypass in the Chamilo vChamilo plugin's phar:// wrapper filter. Mixed-case Phar:// input passes the str_starts_with() check, allowing PHP deserialization via file-system functions.
Is your app exploitable through CVE-2025-52998?
Scan your domain free