10

CVE-2004-0542

EPSS 11.6%
Published 06.08.2004 04:00:00
Last modified 03.04.2025 01:03:51
Source cve@mitre.org
Teams watchlist Login
Open Login

PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.

Affected products Warnungen 0 Metrics 2 CWE 0 References 6

Data is provided by the National Vulnerability Database (NVD)

Php ≫ Php Version < 4.3.7

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	11.6%	0.934

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

http://www.idefense.com/application/poi/display?id=108

Not Applicable

http://www.php.net/release_4_3_7.php

Patch

Vendor Advisory

Release Notes

https://exchange.xforce.ibmcloud.com/vulnerabilities/16331

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2004-0542

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2004-0542

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2004-0542

EUVD