a1ex-var1amov/ctf-cve-2024-4577CTF challenge demonstrating CVE-2024-4577 PHP CGI argument injection, with vulnerable app, attack scripts, and Kubernetes/Docker deployment for hands-on exploitation practice.
This CTF challenge demonstrates CVE-2024-4577, a critical PHP CGI argument injection vulnerability affecting PHP versions 8.1.x < 8.1.21, 8.2.x < 8.2.8, and 8.3.x < 8.3.1.
CVE-2024-4577 is a PHP CGI argument injection vulnerability that occurs when PHP is configured to run as a CGI handler. Attackers can inject command-line arguments to the PHP interpreter through crafted HTTP requests, potentially leading to remote code execution.
You are given access to a vulnerable PHP application running on a web server. Your goal is to exploit the CVE-2024-4577 vulnerability to read the flag file located at /flag.txt.
vulnerable-app/ - The vulnerable PHP applicationattack-scripts/ - Automated attack scriptskubernetes/ - Kubernetes deployment manifestsdocker/ - Docker configuration filesThis CTF is for educational purposes only. Do not use these techniques against systems you don't own or have explicit permission to test.