Command Injection Affecting php package, versions [,8.1.30) [8.2.0,8.2.24) [8.3.0,8.3.12)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (22nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-PHP-8165410
- published 8 Oct 2024
- disclosed 7 Oct 2024
- credit HuanGMz, s0duku, m4yfly
How to fix?
Upgrade php to version 8.1.30, 8.2.24, 8.3.12 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection via the manipulation of CGI parameters. An attacker can inject arbitrary parameters by exploiting non-standard configurations of Windows codepages.
Notes:
This is only exploitable if the ACP codepage is pointed to an OEM codepage through the registry, a configuration that is unlikely to occur in a real environment.
This vulnerability is a bypass of CVE-2024-4577.