OS Command Injection in PHP - CVE-2024-8926

Vulnerability identifier: #VU97691

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-8926

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in PHP-CGI implementation. A remote attacker can send specially crafted HTTP request to the application and execute arbitrary OS commands on the system.

Note, the vulnerability exists due to incomplete fix for #VU91106 (CVE-2024-4577).

PHP
Debian Linux
Slackware Linux
openEuler
Anolis OS
Fedora
Oracle Solaris
EasyApache
php-sodium
php-soap
php-snmp
php-process
php-pgsql
php-pdo
php-opcache
php-odbc
php-mysqlnd
php-mbstring
php-ldap
php-intl
php-help
php-gmp
php-gd
php-fpm
php-ffi
php-enchant
php-embedded
php-devel
php-debugsource
php-debuginfo
php-dbg
php-dba
php-common
php-cli
php-bcmath
php
php-tidy
php-xml
php81
php-zip
php8.2 (Debian package)

Install updates from vendor's website.

PHP - addressed in versions 8.1.30, 8.2.24, 8.3.12
EasyApache - update to 4 2024-10-2
php-sodium - update to 8.0.30-6
php-soap - update to 8.0.30-6
php-snmp - update to 8.0.30-6
php-process - update to 8.0.30-6
php-pgsql - update to 8.0.30-6
php-pdo - update to 8.0.30-6
php-opcache - update to 8.0.30-6
php-odbc - update to 8.0.30-6
php-mysqlnd - update to 8.0.30-6
php-mbstring - update to 8.0.30-6
php-ldap - update to 8.0.30-6
php-intl - update to 8.0.30-6
php-help - update to 8.0.30-6
php-gmp - update to 8.0.30-6
php-gd - update to 8.0.30-6
php-fpm - update to 8.0.30-6
php-ffi - update to 8.0.30-6
php-enchant - update to 8.0.30-6
php-embedded - update to 8.0.30-6
php-devel - update to 8.0.30-6
php-debugsource - update to 8.0.30-6
php-debuginfo - update to 8.0.30-6
php-dbg - update to 8.0.30-6
php-dba - update to 8.0.30-6
php-common - update to 8.0.30-6
php-cli - update to 8.0.30-6
php-bcmath - update to 8.0.30-6
php - update to 8.0.30-6
php-tidy - update to 8.0.30-6
php-xml - update to 8.0.30-6
php81 - update to 8.1.30
php-mbstring - update to 8.2.24-1
php-mysqlnd - update to 8.2.24-1
php-gd - update to 8.2.24-1
php-odbc - update to 8.2.24-1
php-ldap - update to 8.2.24-1
php-intl - update to 8.2.24-1
php-gmp - update to 8.2.24-1
php-zip - update to 8.2.24-1
php-opcache - update to 8.2.24-1
php-pdo - update to 8.2.24-1
php-pgsql - update to 8.2.24-1
php-process - update to 8.2.24-1
php-snmp - update to 8.2.24-1
php-soap - update to 8.2.24-1
php-sodium - update to 8.2.24-1
php-xml - update to 8.2.24-1
php-fpm - update to 8.2.24-1
php-ffi - update to 8.2.24-1
php-enchant - update to 8.2.24-1
php-embedded - update to 8.2.24-1
php-devel - update to 8.2.24-1
php-dbg - update to 8.2.24-1
php-dba - update to 8.2.24-1
php-common - update to 8.2.24-1
php-cli - update to 8.2.24-1
php-bcmath - update to 8.2.24-1
php - update to 8.2.24-1
php - addressed in versions 8.2.24-1.fc39, 8.3.12-1.fc40, 8.3.12-1.fc41
php8.2 (Debian package) - update to 8.2.24-1~deb12u1
Oracle Solaris - update to 11.4 SRU 77

• Exploit #11226 - php-cgi-Injector (March 18, 2025)

• https://www.php.net/ChangeLog-8.php#8.1.30
• https://www.php.net/ChangeLog-8.php#8.2.24
• https://www.php.net/ChangeLog-8.php#8.3.12

• Fedora 41 update for php
• Fedora 40 update for php
• Fedora 39 update for php
• Multiple vulnerabilities in PHP
• Debian update for php8.2
• openEuler update for php
• Multiple vulnerabilities in cPanel EasyApache
• Slackware Linux update for php81
• Oracle Solaris update for third-party components
• Anolis OS update for php