Threats tagged 'bit-php-2024-4577'

A critical vulnerability (CVE-2024-4577) affects PHP-CGI on Windows when used with Apache and certain code pages. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8, Windows may apply "Best-Fit" character replacement in command-line arguments, causing PHP-CGI to misinterpret these as PHP options. This can allow attackers to pass malicious options to the PHP binary, potentially exposing source code or enabling arbitrary code execution.