CVE-2024-4577 PoC — Argument Injection in PHP-CGI

Source

https://github.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP

Associated Vulnerability

Title: Argument Injection in PHP-CGI (CVE-2024-4577)
Description:In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Readme

# TG Join Us https://t.me/WanLiChangChengWanLiChang
加入我们定时查收各类漏洞 EXP POC
# CVE-2024-4577-RCE-EXP
CVE-2024-4577 PHP CGI Windows平台远程代码执行漏洞

CVE-2024-4577 PHP CGI Windows平台远程代码执行漏洞RCE EXP 批量利用程序

# FOFA
app="XAMPP" 
  
# 注意事项 
该RCE仅限在简体中文 繁体中文 以及日文的Windows操作系统中有效

# 使用方法 How To Use
第31行修改CMD命令

第56行修改读取文件

第57行修改线程

Change Cmd in Line 31

Change ReadFileName in Line 56

Change Threads count in Line 57

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →