blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-3566

CRITICAL 9.8 CVSS 3.1
Published
April 10, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
cret@cert.org
Weakness
CWE-77
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Affected products and versions

  • PHP — Before 8.1.28
  • PHP — From 8.2.0 (including) to 8.2.18 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.6 (excluding)

References

  • flatt.tech https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ Exploit, Third Party Advisory
  • kb.cert.org https://kb.cert.org/vuls/id/123335 Third Party Advisory
  • learn.microsoft.com https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way Technical Description
  • www.cve.org https://www.cve.org/CVERecord?id=CVE-2024-1874 Not Applicable
  • www.cve.org https://www.cve.org/CVERecord?id=CVE-2024-22423 Not Applicable
  • www.cve.org https://www.cve.org/CVERecord?id=CVE-2024-24576 Not Applicable
  • www.kb.cert.org https://www.kb.cert.org/vuls/id/123335 Not Applicable
  • github.com https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566 Third Party Advisory
  • nvd.nist.gov Official NVD record