Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

PHP-CGI Argument Injection Remote Code Execution

Best-Fit character encoding conversion flaw in Windows PHP-CGI implementation enabling unauthenticated remote code execution via crafted query string arguments.

Status
Vendor Patched
Reported / Disclosed
2024

Impact

  • Bypass of command-line argument sanitization through Unicode soft hyphen (0xAD) character substitution.
  • Arbitrary PHP code execution through -d allow_url_include=1 directive injection.
  • Full web server compromise on default XAMPP and IIS installations without credentials.

Timeline

  1. MAY 2024

    Vulnerability reported to PHP security team by DEVCORE research group.

  2. JUNE 6, 2024

    Official PHP 8.3.8, 8.2.20, and 8.1.29 security maintenance releases published.

  3. JUNE 2024

    Widespread honeypot detection and proof-of-concept exploit verification.

aura~
Back to CVEs & Disclosures