Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
NA

CVE-2024-1874

Published: 29/04/2024 Updated: 29/04/2024

Vulnerability Summary

In PHP versions 8.1.* prior to 8.1.28, 8.2.* prior to 8.2.18, 8.3.* prior to 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell. 

Vulnerability Trend

Mailing Lists

Full Disclosure: PHP security releases 8.1.28, 8.2.18, & 8.3.6
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> PHP security releases 8128, 8218, &amp; 836 <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: Alan Coopersmit ...

Github Repositories

https://github.com/michalsvoboda76/batbadbut

investigating the BatBadBut vulnerability,

outcome of the here implemented batbadbut_incsharpexe &gt; batbadbut_incsharpexe Hello! I am going to run following command Guess what will happen ;-) cmd /C echo "\"&amp;calcexe" See? The calcexe was started on your computer Bye! Press any key to stop this console program "\" BatBadBut vulnar

References

https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7https://nvd.nist.govhttps://github.com/michalsvoboda76/batbadbuthttps://www.kb.cert.org/vuls/id/123335
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook