PHP: Arbitrary Function call example

arbitrary-func-call.php

<?php 
class hacker{
	
	private function secret() {
		echo "<h2 style='color:red'>Executed secret or privilaged operations.</h2>";
		
	}
	public function test($arg){
		${"func"} = $arg;
		$this->${"func"}();
		
	}
	public function nonsecret(){
		
		echo "<h2 style='color:green'>Executed non-secret or non-privileged operation.</h2>";
	}
	
}

$payload = isset($_GET["func"])?$_GET["func"]:"nonsecret";

$h = new hacker();
$h->test($payload);

?>