CVE-2024-1874

CRITICAL

PHP <8.1.28, 8.2.<8.2.18, 8.3.<8.3.5 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-1874. PoCs published by Tgcohce.

AI-analyzed exploit summary The repository contains functional exploit code demonstrating CVE-2024-1874, a command injection vulnerability in PHP's proc_open() function. It includes PoCs in both PHP and Python that bypass the original fix by leveraging trailing spaces in command names.

Description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Exploits (1)

nomisec WORKING POC 2 stars

by Tgcohce · poc

https://github.com/Tgcohce/CVE-2024-1874

View Code ZIP pw:eip

The repository contains functional exploit code demonstrating CVE-2024-1874, a command injection vulnerability in PHP's proc_open() function. It includes PoCs in both PHP and Python that bypass the original fix by leveraging trailing spaces in command names.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8

No auth needed

Prerequisites: Target running vulnerable PHP version · Ability to supply malicious arguments to proc_open()

MITRE ATT&CK