Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Craft CMS register_argc_argv RCE (CVE-2024-56145) - Vulnerability Database

Craft CMS register_argc_argv RCE (CVE-2024-56145)

Description

Invicti has identified that Craft CMS is vulnerable to remote code execution (RCE) due to the register_argc_argv setting being enabled in the php.ini configuration. This setting allows command-line arguments to be passed to PHP scripts, potentially enabling attackers to execute arbitrary code on the server.

Remediation

Upgrade to the latest version of Craft CMS or disable register_argc_argv

References

Potential RCE when PHP `register_argc_argv` config setting is enabled
How an obscure PHP footgun led to RCE in Craft CMS

Related Vulnerabilities

Nginx PHP code execution via FastCGI High
Common tags: Code Execution Known Vulnerabilities
WooFramework shortcode exploit High
Common tags: Code Execution Known Vulnerabilities
Gallery 3.0.4 remote code execution High
Common tags: Code Execution Known Vulnerabilities
Apache OFBiz RCE (CVE-2024-32113/CVE-2024-36104/CVE-2024-38856) Critical
Common tags: Code Execution Known Vulnerabilities
Ektron CMS unauthenticated code execution and Local File Read High
Common tags: Code Execution Known Vulnerabilities

Severity

Critical

Classification

CVE-2024-56145
CWE-94
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution
Known Vulnerabilities