CVE-2024-4577 PoC — Argument Injection in PHP-CGI

Source

https://github.com/XiangDongCJC/CVE-2024-4577-PHP-CGI-RCE

Associated Vulnerability

Title: Argument Injection in PHP-CGI (CVE-2024-4577)
Description:In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Readme

# 本文是专为了php-CGi-RCE漏洞所编写的yaml文件-高危
## 简介
    php-CGi是一种用在web服务器运行php脚本的接口，通过cgi(公共网关接口)将php解释器与web服务器连接
## 漏洞产生原因
    php在设计时忽略windows中对字符转换的Best-Fit特性，当php-cgi运行在windows且使用了如下语系(简体中文936/繁体950/日文932等),攻击者可绕过cve-2012-1823补丁，从而可在无需登陆的缺考下执行任意php代码
## 影响版本
    PHP Windows版 8.3.0<=影响版本<8.3.8
    PHP windows版 8.2.0<=影响版本<8.2.20
    PHP Windows版 8.1.0<=影响版本<8.1.29
    XAMPP windows版影响版本<= 8.2.12
    XAMPP Windows版影响版本<= 8.1.25
    XAMPP windows版影响版本<= 8.0.30
# 参考
    公众号：nday POC  
    可以将该文件配合nuclei工具来使用。刷洞嘛,肯定要开开心心的刷洞。
    如有问题,可以提出来,谢谢

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →