Every CVE Search/ Get API key

CVE-2024-4577

Argument Injection in PHP-CGI

9.8 CriticalIn KEVPublic exploitFix available

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.0 points since Jun 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

Argument Injection in PHP-CGI

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
CVE-2024-4577
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2024-44188 9.8

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
EUVD-2024-44188
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vxpp-6299-mxw3 9.8

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache...

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
GHSA-vxpp-6299-mxw3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
CISA KEV No score

PHP-CGI OS Command Injection Vulnerability

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

Record
CVE-2024-4577
Weakness
CWE-78
Updated
2026-11-02
NVD 9.8

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
CVE-2024-4577
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVALPINE-CVE-2024-4577 9.8

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
ALPINE-CVE-2024-4577
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 8 moreShow less
OSVAZL-42424 9.8

CVE-2024-4577 affecting package php for versions less than 8.1.29-1

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
AZL-42424
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-42433 9.8

CVE-2024-4577 affecting package php for versions less than 8.3.8-1

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
AZL-42433
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVBELL-CVE-2024-4577 9.8

CVE-2024-4577 does not affect BellSoft software

Record
BELL-CVE-2024-4577
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Argument Injection in PHP-CGI

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
CVE-2024-4577
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVBIT-libphp-2024-4577 No score

Argument Injection in PHP-CGI

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
BIT-libphp-2024-4577
Updated
2026-11-02
OSVBIT-php-2024-4577 No score

Argument Injection in PHP-CGI

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
BIT-php-2024-4577
Updated
2026-11-02
OSVBIT-php-min-2024-4577 No score

Argument Injection in PHP-CGI

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Record
BIT-php-min-2024-4577
Updated
2026-11-02
OSVopenSUSE-SU-2024:14376-1 No score

php8-8.3.12-1.1 on GA media

These are all security issues fixed in the php8-8.3.12-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14376-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php81
Alpine:v3.19
 before 8.1.29-r0
8.1.29-r0
php82
Alpine:v3.19
 before 8.2.20-r0
8.2.20-r0
php83
Alpine:v3.19
 before 8.3.8-r0
8.3.8-r0
php
Azure Linux:2
 before 8.1.29-1
8.1.29-1
php
Azure Linux:3
 before 8.3.8-1
8.3.8-1
libphp
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8
php
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8
php-min
Bitnami
 before 8.1.29, 8.2.0 up to 8.2.20, 8.3.0 up to 8.3.8
8.1.298.2.208.3.8
php8
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 8.3.12-1.1
8.3.12-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPHP CGI Argument Injection Remote Code Execution2024-06-06
PoC in GitHub11whoami99/CVE-2024-45772024-06-07
PoC in GitHubRa1n-60W/CVE-2024-45772024-06-07
PoC in GitHubSysc4ll3r/CVE-2024-45772024-06-07
PoC in GitHubTAM-K592/CVE-2024-45772024-06-07
PoC in GitHubWanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP2024-06-07
PoC in GitHubgraphite-org/CVE-2024-45772024-06-07
PoC in GitHubhuseyinstif/CVE-2024-4577-Nuclei-Template2024-06-07
PoC in GitHubprincew88/CVE-2024-45772024-06-07
PoC in GitHubtaida957789/CVE-2024-45772024-06-07
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubwatchtowrlabs/CVE-2024-45772024-06-07
PoC in GitHub0x20c/CVE-2024-4577-nuclei2024-06-08
PoC in GitHubZephrFish/CVE-2024-4577-PHP-RCE2024-06-08
PoC in GitHubmanuelinfosec/CVE-2024-45772024-06-08
PoC in GitHubxcanwin/CVE-2024-4577-PHP-RCE2024-06-08
PoC in GitHubzomasec/CVE-2024-45772024-06-08
PoC in GitHubChocapikk/CVE-2024-45772024-06-09
PoC in GitHubdbyMelina/CVE-2024-45772024-06-09
PoC in GitHubBLACK-ARCHIVERS/CVE-2024-45772024-06-11
PoC in GitHubbl4cksku11/CVE-2024-45772024-06-11
PoC in GitHub0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE2024-06-12
PoC in GitHubEntropt/CVE-2024-4577_Analysis2024-06-12
PoC in GitHubaavamin/cve-2024-45772024-06-12
PoC in GitHubd3ck4/Shodan-CVE-2024-45772024-06-12
PoC in GitHubSh0ckFR/CVE-2024-45772024-06-13
PoC in GitHubgotr00t0day/CVE-2024-45772024-06-15
Exploit-DBPHP CGI Module 8.3.4 - Remote Code Execution (RCE)2025-06-15
NucleiPHP CGI - Argument Injection

History

History
RecordedChangedSources
affectedOSV
exploitation
affected, aliases, referencesOSV
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-4577 is a critical vulnerability (CVSS 9.8) in Php, published June 9, 2024. CISA lists it as known to be exploited, since June 12, 2024. EUVD reports exploitation since June 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in php81 8.1.29-r0.

References

Show 26 moreShow less
This page doesn't list everything

The full exploit list has 48 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open