CVE-2024-4577
Argument Injection in PHP-CGI
- Published
- Jun 9, 2024
- Updated
- Oct 21, 2025
- Assigning CNA
- php
- Evidence observed
- Jun 12, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Sources
65- CVE-2024-4577-nucleiScanner
CVE-2024-4577 nuclei-templates
- CVE-2024-4577-PHP-CGI-RCEExploit
Nuclei YAML template for CVE-2024-4577, a Windows PHP-CGI argument injection vulnerability enabling unauthenticated RCE in affected PHP and XAMPP setups.
- CVE-2024-4577Exploit
POC & $BASH script for CVE-2024-4577
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.