Vulnerability in PHP

CVE-2004-0542

PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.

EPSS: 0.311 (98.1th percentile) — read the EPSS interpretation.

Affected products

  • Php
  • N/a — versions n/a

Public proof-of-concept exploits

References

  • cve@mitre.org (x_refsource_CONFIRM, Patch, Release Notes, Vendor Advisory)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_MISC, Not Applicable)

Frequently asked questions

What is CVE-2004-0542?
CVE-2004-0542 is a vulnerability in PHP. Published 2004-08-06.
Is CVE-2004-0542 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.