Executive brief
A critical security flaw was identified in the PHP CGI program that could allow an unauthorized person to gain remote access to a web server's command shell. PHP is a widely used scripting language for web development, and this component handles how scripts interact with the server. An attacker exploiting this could take full control of the server, potentially leading to data theft, website defacement, or complete service disruption.
Technical details
A buffer overflow vulnerability exists in the php.cgi component of early PHP implementations. The flaw is triggered when the CGI program processes maliciously crafted input, leading to memory corruption. A remote, unauthenticated attacker can exploit this by sending a specific request to the web server, allowing for arbitrary code execution with the privileges of the web server process. This typically results in the attacker gaining interactive shell access. Users should ensure they are using modern, patched versions of PHP as this issue affects legacy CGI configurations.
Affected products
- PHP Group PHP Versions prior to 1997-04-17
Timeline
- 1997-04-17: disclosed: Initial publication date of the vulnerability.