CVE-2024-4577
Argument Injection in PHP-CGI
KEV RANSOMWARECRITICAL 9.8EPSS 100.0%
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- Affected
- PHP Group · PHP
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 99.99% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-06-12, used in ransomware campaigns
- Nuclei
- critical · CWE-78
- Published
- 2024-06-09
- Updated
- 2025-10-21
Proof-of-concept exploits (76)
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malici…
- php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
- watchtowrlabs/CVE-2024-4577322★ · 2024-06-22
- https://isc.sans.edu/diary/30994
- https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-202…
- 0x20c/CVE-2024-4577-nuclei5★ · 2024-06-08
- AlperenY-cs/CVE-2024-45772★ · 2024-06-29
- BTtea/CVE-2024-4577-RCE-PoC25★ · 2024-11-20
- BitMEXResearch/CVE-2024-45770★ · 2024-06-07
- Chocapikk/CVE-2024-457735★ · 2026-01-24
- CirqueiraDev/MassExploit-CVE-2024-45775★ · 2025-12-03
- Dejavu666/CVE-2024-45770★ · 2025-01-08
- Didarul342/CVE-2024-45770★ · 2025-02-14
- Gill-Singh-A/CVE-2024-4577-Exploit0★ · 2025-04-18
- Ianthinus/CVE-2024-45770★ · 2025-08-20
- Jcccccx/CVE-2024-45770★ · 2024-07-31
- KimJuhyeong95/cve-2024-45770★ · 2025-05-27
- Night-have-dreams/php-cgi-Injector52★ · 2025-03-29
- PhinehasNarh/CVE-2024-4577-Defend1★ · 2024-06-24
- Ra1n-60W/CVE-2024-45770★ · 2024-06-07
- Sh0ckFR/CVE-2024-45774★ · 2024-06-13
- Skycritch/CVE-2024-45770★ · 2025-09-03
- Sysc4ll3r/CVE-2024-45771★ · 2024-06-07
- TAM-K592/CVE-2024-457775★ · 2024-06-11
- VictorShem/CVE-2024-45772★ · 2024-07-31
- WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP0★ · 2024-06-07
- Wh02m1/CVE-2024-45771★ · 2024-06-07
- XiangDongCJC/CVE-2024-4577-PHP-CGI-RCE1★ · 2024-06-12
- Yukiioz/CVE-2024-45770★ · 2024-06-07
- ZephrFish/CVE-2024-4577-PHP-RCE33★ · 2026-07-30
- a-roshbaik/CVE-2024-4577-PHP-RCE0★ · 2024-07-24
- aaddmin1122345/CVE-2024-4577-POC5★ · 2024-09-10
- aaddmin1122345/cve-2024-45775★ · 2024-09-10
- ahmetramazank/CVE-2024-45770★ · 2024-11-03
- bibo318/CVE-2024-4577-RCE-ATTACK5★ · 2024-07-11
- bibo318/Cyberbugs-Tracker0★ · 2025-12-19
- bl4cksku11/CVE-2024-45770★ · 2024-06-11
- bughuntar/CVE-2024-45770★ · 2024-08-17
- byteReaper77/CVE-2024-45772★ · 2025-06-23
- charis3306/CVE-2024-45770★ · 2024-07-03
- d3ck4/Shodan-CVE-2024-45772★ · 2024-06-12
- dbyMelina/CVE-2024-45770★ · 2024-06-09
- eagerapps/CVE-2024-45770★ · 2024-06-07
- fa-rrel/CVE-2024-4577-RCE26★ · 2024-08-20
- ggfzx/CVE-2024-45771★ · 2024-06-26
- gh-ost00/CVE-2024-4577-RCE26★ · 2024-08-20
- gmh5225/CVE-2024-4577-PHP-RCE0★ · 2024-07-15
- gotr00t0day/CVE-2024-457711★ · 2024-06-15
- ildefonso0/php-7.2.34-CVE-20241★ · 2024-07-07
- jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE0★ · 2024-06-18
- l0n3m4n/CVE-2024-4577-RCE7★ · 2024-07-07
- longhoangth18/CVE-2024-45775★ · 2024-10-14
- mananjain61/PHP-CGI-INTERNAL-RCE0★ · 2025-07-11
- manuelinfosec/CVE-2024-457710★ · 2024-06-08
- mistakes1337/CVE-2024-45770★ · 2025-03-21
- mr-won/php-cgi-cve-2024-45770★ · 2025-02-14
- ohhhh693/CVE-2024-45770★ · 2024-06-07
- olebris/CVE-2024-45770★ · 2024-06-28
- phirojshah/CVE-2024-45772★ · 2024-09-12
- r0otk3r/CVE-2024-45770★ · 2025-07-12
- sug4r-wr41th/CVE-2024-45771★ · 2025-04-12
- taida957789/CVE-2024-45771★ · 2024-06-07
- tk-1001/PHPexploit_pack0★ · 2025-06-04
- tntrock/CVE-2024-4577_PowerShell0★ · 2025-05-12
- tpdlshdmlrkfmcla/php-cgi-cve-2024-45770★ · 2025-02-14
- wilss0n/CVE-2024-45770★ · 2025-03-21
- xcanwin/CVE-2024-4577-PHP-RCE160★ · 2024-07-21
- zomasec/CVE-2024-45774★ · 2024-06-09
- 0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE1★ · 2024-06-12
- aavamin/cve-2024-45775★ · 2024-09-10
- graphite-org/CVE-2024-45770★ · 2024-06-07
- razureink/cve-2024-4577-phpcgi_rce_reproduction0★ · 2026-07-23
- BLACK-ARCHIVERS/CVE-2024-45770★ · 2024-06-07
- mrzero-cool/cve-poc-search0★ · 2026-10-15
- 11whoami99/CVE-2024-457743★ · 2024-06-09
- lockbitblack-ai/CVE-2024-4577-new0★ · 2026-02-11
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (1)
Exploit collections (1)
- CVE-2024-4577.yamlzan8in/afrog
Security advisories
- http://www.openwall.com/lists/oss-security/2024/06/07/1
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malici…
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
- https://blog.talosintelligence.com/new-persistent-attacks-japan
- https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-…
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577
- https://security.netapp.com/advisory/ntap-20240621-0008
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024…
- https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577
- rapid7/metasploit-framework/pull/19247
- https://www.php.net/ChangeLog-8.php#8.1.29
- https://www.php.net/ChangeLog-8.php#8.2.20
- https://www.php.net/ChangeLog-8.php#8.3.8