Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
PHP Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Vulnerability - CVE-2024-8926 - Vulnerability Database
PHP

PHP Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Vulnerability - CVE-2024-8926

High
Reference: CVE-2024-8926
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-8926
Title: PHP Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Vulnerability
Overview:

In PHP versions 8.1. before 8.1.30 8.2. before 8.2.24 8.3. before 8.3.12when using a certain non-standard configurations of Windows codepages the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows quotBest Fitquot codepage behavior can be achieved. Thismay allow a malicious user to pass options to PHP binary being run and thus reveal the source code of scripts run arbitrary PHP code on the server etc.