Command Injection Affecting php package, versions [,8.1.29) [8.2.0,8.2.20) [8.3.0,8.3.8)
Threat Intelligence
Exploit Maturity
Mature
EPSS
96.32% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-PHP-7369294
- published 25 Jun 2024
- disclosed 9 Jun 2024
- credit DEVCORE
How to fix?
Upgrade php to version 8.1.29, 8.2.20, 8.3.8 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection when using Apache and PHP-CGI on Windows. If the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts or run arbitrary PHP code on the server.