Vulnerability Description
PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | < 4.3.7 |
References
- http://www.idefense.com/application/poi/display?id=108Not Applicable
- http://www.php.net/release_4_3_7.phpPatchRelease NotesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16331Third Party AdvisoryVDB Entry
- http://www.idefense.com/application/poi/display?id=108Not Applicable
- http://www.php.net/release_4_3_7.phpPatchRelease NotesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16331Third Party AdvisoryVDB Entry
FAQ
What is CVE-2004-0542?
CVE-2004-0542 is a vulnerability with a CVSS score of 10.0 (HIGH). PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environmen...
How severe is CVE-2004-0542?
CVE-2004-0542 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2004-0542?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php.