CVE-2024-4577

unknown KEV
Published 2024-06-12 Β· Modified 2024-06-12
CVSS v3
β€”
CVSS v4 NEW
β€”
not yet in upstream
VIR risk
2.5

Description

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

CISA KEV

Vendor
PHP Group
Product
PHP
Due date
2024-07-03

Predictions

Exploit likelihood
99%
Patch ETA
β€”

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27
{Vendor advisory: cisa-kev β€” This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577}

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-52331 webapps php
Δ°brahimsql Β· 2025-06-15

PHP CGI Module 8.3.4 - Remote Code Execution (RCE)

Source code queued for fetch β€” refresh in a moment.

Metasploit modules

PHP CGI Argument Injection Remote Code Execution
Source fetch failed: fetch_error β€” view the original via the link above.

OS impact

suse SUSE Affected 1 release
VersionStatusFixed in
β€” Affected β€”
debian Debian Fixed 2 releases
VersionStatusFixed in
bullseye Fixed 0
bookworm Fixed 0

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.