Exploit Report

Computer Security And Bug Information


CVE Title
Published Date2024-06-09T20:15Z
Modified Date2024-06-13T04:15Z
CWE TypeCWE-78
DescriptionIn PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
By clicking these links you will leave this website. We do not endorse and will not be held accountable for any activity on external sites.
Reference URLhttps://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
Reference Description https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
Reference URLhttps://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
Reference Description https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
Reference URLhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Reference Description https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Reference URLhttps://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
Reference Description https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
Reference URLhttps://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
Reference Description https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
TagsBroken Link

This site's data is aggregated programmatically and provided "as is" without any representations or warranties, express or implied. Exploit.report is not affiliated with the The MITRE Corporation, U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), or US government in any way. CVE and the CVE logo are registered trademarks of The MITRE Corporation

© 2022 Exploit.Report | Data | Contact | Privacy Policy | Articles