---
type: Article
title: "CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!"
description: A short note on CVE-2024-4577 published alongside the official PHP advisory, written while the author prepared his Black Hat Apache talk. It reports that the php-cgi argument-injection patch reviewed and trusted for twelve years is bypassed by a minor Windows character-conversion feature, letting unauthenticated attackers run arbitrary code through particular character sequences; XAMPP for Windows is affected in its default configuration.
resource: "https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/"
tags: [article, webseclist-reference, en, devcore, php, rce, cve, injection, filter-bypass, encoding, charset, owasp-a02-2021, owasp-a03-2021, owasp-a05-2021]
generated:
  by: webseclist-refs/1
  at: "2026-08-12T15:09:30+00:00"
status: stable
stale_after: 2027-08-12
sources:
  - id: original
    resource: "https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/"
    title: "CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!"
    author: Orange Tsai
    last_modified: 2024-06-06
also_at: []
authors:
  - Orange Tsai
canonical_url: ""
cited_by:
  - "2024.md:158"
commit: ""
content_sha256: 45ecdf8e86b5f76c53faa057d866f3dfdfbb8385e897e6d8ac4a120beb31a191
depth: full
depth_reason: default
kind: article
language: en
licence: unknown
original_url: "https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/"
published: 2024-06-06
publisher: DEVCORE
publisher_english: ""
raw_sha256: 247c44fa54c1a2952eb3e3d2136a3f22843cee3bcf5988794fc849a2132762b0
retrieved_from: "https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/"
retrieved_kind: stored
retrieved_utc: "2026-08-12T15:09:30+00:00"
slug: 2024-orange-tsai-cve-2024-4577-yet-another-php-rce-make-php-cgi-argument-again
snapshot: ""
title_english: ""
translation_file: ""
translation_of: ""
---

# CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!

**CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!** - Orange Tsai, DEVCORE.

- Published: 2024-06-06
- Original: <https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/>
- Preserved from: https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/ (stored) on 2026-08-12
- Licence: unknown

Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.

## Content

> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.

📌 [ [繁體中文](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/) | [English](https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/) ]

![preview](https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/9ef1d76c4dc7587c-01.jpg)

This is a side story/extra bug while I’m preparing for my [Black Hat USA](https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-40227) presentation. I believe most of the details have already been covered in the [official advisory](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv) (should be published soon). Although PHP-CGI has gradually been phased out over time, **this vulnerability affects [XAMPP for Windows](https://www.apachefriends.org/) by default**, allowing unauthenticated attackers to execute arbitrary code on remote XAMPP servers through specific character sequences.

Given the widespread use of PHP and XAMPP in the web ecosystem, I urge everyone to check if they are affected and update their systems accordingly. Please refer to the [Security Alert published by DEVCORE](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/) for mitigation measures.

This vulnerability is incredibly simple, but that’s also what makes it interesting. Who would have thought that a patch, which **has been reviewed and proven secure for the past 12 years, could be bypassed** due to a [minor Windows feature](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ucoderef/d1980631-6401-428e-a49d-d71394be7da8)? I believe this feature could lead to more potential vulnerabilities. If you use this technique, don’t forget to reference to this article! 😉