Exploit for OS Command Injection in Php

## https://sploitus.com/exploit?id=D0B8A3C4-E2D5-5C6A-A4CD-CA53338ACFEC
# CVE-2024-4577 Mass Scanner & Exploit Tool (PoC)

This Python script automates the detection of servers vulnerable to **CVE-2024-4577**, a critical vulnerability in PHP-CGI that allows **remote code execution (RCE)** through specially crafted query parameters.

The tool sends a PHP payload (``) using `auto_prepend_file=php://input` and detects vulnerability by analyzing the server's response for signs of successful code execution.



# Affected Versions

based on the original [https://devco.re/](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/) This vulnerability affects all versions of PHP installed on the Windows operating system:
```
PHP 8.3 

## Usage

```bash
pip install -r requirements.txt
```

```bash
python CVE-2024-4577.py list.txt 50
```

- `list.txt`: A file containing one domain per line
- `50`: Number of threads to use



## Output

- Vulnerable URLs are saved to `vulnerable.txt`



## Disclaimer

This tool is created **for educational purposes or authorized security assessments only**.  
Unauthorized scanning or exploitation of third-party systems is **illegal** and may violate service terms or criminal laws.  
Use responsibly.



**Coded by CirqueiraDev**