Jun 9, 2024

Updated

• Closed✓Patched

  PHP-CGI argument injection on Windows (CVE-2024-4577)

  A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.

  PHP Group PHP·Closed Jun 12, 2024·updated Jun 12, 2024