Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2024-1874

Command injection via array-ish $command parameter of proc_open()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.28affected
  • 8.2.* to < 8.2.18affected
  • 8.3.* to < 8.3.5affected

References