Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Windows PHP Component Object Model 操作系统命令注入漏洞
Vulnerability Description
Windows上的PHP 5.x版本的Component Object Model (COM)函数没有遵循safe_mode and disable_functions限制, 攻击者可以借助compatUI.dll中的一个函数，绕过预设的限制，例如执行具有相应的ActiveX控件 Compatibility标记的kill bit设置的执行标的和执行程序。
CVSS Information
N/A
Vulnerability Type
N/A