CVE-2024-8926CWE-78

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

High · published October 8, 2024

CVSS v3.1
8.1
EPSS
4%
Percentile
89.6
In the wild
Unconfirmed
What it is

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03662 · 89.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-10-08T03:48Z
EPSS history
Timeline
  • 08 OCT 03:48Z
    PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
    cvelistv5