CVE-2024-4577 PoC — Argument Injection in PHP-CGI

Source

Associated Vulnerability

Readme

# PHP CGI argument injection to RCE (CVE-2024-4577) - exploit code

The CVE-2024-4577 vulnerability in PHP CGI has emerged as a critical security flaw, allowing remote code execution through argument injection. Discovered in multiple PHP versions, this vulnerability primarily affects servers running in specific locales (Traditional Chinese, Simplified Chinese, Japanese) on Windows.

The flaw exploits the PHP CGI mode, bypassing previous security measures and enabling unauthenticated attackers to execute arbitrary code.

## Usage
Exploit script:
```
usage: python exploit.py -t http://127.0.0.1 -c calc

options:
  -h, --help            show this help message and exit
  --target TARGET, -t TARGET
                        Target URL
  --code CODE, -c CODE  OS command to execute
  --php PHP, -p PHP     PHP command to execute
```

Example:
```
python3 exploit.py 192.168.130.100 80 calc
python .\CVE-2024-4577.py -t http://127.0.0.1 -p "<?php system('calc') ?>"
```

![kép](https://github.com/jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE/assets/42498816/e4c67a42-2cc5-487e-bf78-26544b662e22)

## Disclaimer
This exploit script has been created solely for research and the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The script's author and owner disclaim any responsibility or liability for any misuse or damage caused by this software. Just so you know, users are urged to use this software responsibly and only by applicable laws and regulations. Use responsibly.

File Snapshot

 [4.0K]  /data/pocs/dd89e69ef3866f0084854971383c5aff2234fa22
├── [ 923]  exploit.py
├── [1.0K]  LICENSE
└── [1.5K]  README.md

0 directories, 3 files

Remarks