Описание
The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.
Ссылки
- Patch
- Vendor Advisory
- ExploitPatch
- Patch
- Vendor Advisory
- ExploitPatch
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:kyberdigi_labs:php-exec-dir:4.3.7:*:*:*:*:*:*:*
EPSS
Процентиль: 93%
0.09857
Низкий
9.3 Critical
CVSS2
Дефекты
CWE-16
Связанные уязвимости
github
почти 4 года назад
The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.
EPSS
Процентиль: 93%
0.09857
Низкий
9.3 Critical
CVSS2
Дефекты
CWE-16