Unrated severityNVD Advisory· Published Apr 29, 2024· Updated Nov 4, 2025
Command injection via array-ish $command parameter of proc_open()
CVE-2024-1874
Description
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.openwall.com/lists/oss-security/2024/04/12/11mitre
- www.openwall.com/lists/oss-security/2024/06/07/1mitre
- github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/mitre
- security.netapp.com/advisory/ntap-20240510-0009/mitre
News mentions
0No linked articles in our index yet.