Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-0542: PHP on Windows can execute unwanted code

CVE-2004-0542 · published 22 years ago

Summary

Versions of PHP older than 4.3.7 running on Windows do not correctly remove certain characters that control the command line. Because of this, a malicious user could cause the server to run their own code, change or delete files, and view hidden system settings. Upgrade PHP to version 4.3.7 or later, or apply a patch that properly sanitizes command‑line input.

What to do

Update php php to version 4.3.7 or later.

Affected software

Vendor	Product	Affected versions
php	php	< 4.3.7 `cpe:2.3:a:php:php::::::::`

Original advisory text

PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.

References

http://www.idefense.com/application/poi/display?id=108 Not Applicable
http://www.php.net/release_4_3_7.php Patch Release Notes Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16331 Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

31% chance of attack within 30 days

Timeline

Published6 Aug 2004

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2004-0542 · NVD

Track software like this

Free during beta