CVE-2024-1874criticalCWE-116

Command injection via array-ish $command parameter of proc_open()

60Vexday Risk Score

Keep watching. It has a public proof of concept.

ssvc Attendcvss 9.4epss 33%

from disclosure to weapon0 days

Published on NVDApr 29

1st PoCApr 17

exploitation probability

33%top 2% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

PHP Group · PHP

public PoCs found — 2

githubgithub.com/Tgcohce/CVE-2024-1874★ 2 githubgithub.com/ox1111/-CVE-2024-1874-★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References