CVE-2004-0542

high · 10

PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.

CVSS

31.1%

EPSS (exploit prob.)

98th

EPSS percentile

2004-08-06

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Vendor	Product	Affected versions
php	php	< 4.3.7

Check a specific version with /api/v1/cve/match.

References

http://www.idefense.com/application/poi/display?id=108
http://www.php.net/release_4_3_7.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/16331
http://www.idefense.com/application/poi/display?id=108
http://www.php.net/release_4_3_7.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/16331

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2004-0542