Summary

same as CVE-2024-1874

due to the improper handling of command line arguments on Windows, maliciously crafted arguments can inject arbitrary commands even if the bypass_shell option is enabled.

Details

Add a space at the end of filename, others are the same as CVE-2024-1874

PoC

1. Save the following file as test.bat

echo hello

2. Save the following file as 1.php, notiece the space at the end of argv-filename

 true));
proc_close($proc);

3. Run it with PHP and confirm that notepad.exe is popped up.

Impact

Malicious command line arguments in windows platform