CVE-2024-5585

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

We have discovered 159,286 live websites that are affected by CVE-2024-5585.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains159,286 live websites (2.36% of PHP install base)
Vulnerable Versions
  • from 8.1 through 8.1.29
  • from 8.2 through 8.2.20
  • from 8.3 through 8.3.8
Vulnerable Versions Count57 versions ( 11% of all versions)


Common Weakness Enumeration

CWE-116 Improper Encoding or Escaping of Output



Details

  • Published - Jun 9, 2024
  • Updated - Feb 13, 2025

Credits

  • tianstcht (reporter)

Website Distribution by Country

Number of websites using CVE-2024-5585
United States18,227 websites


France77,174 websites
Russia8,332 websites
Brazil5,798 websites
Netherlands4,874 websites
Germany4,800 websites
Italy4,427 websites
Poland3,913 websites
Spain2,729 websites
GB2,023 websites

Website Distribution by TLD

Number of websites using CVE-2024-5585
.com53,480 websites
.fr32,205 websites
.ru7,306 websites
.org6,148 websites
.com.br4,852 websites
.nl4,632 websites
.net4,489 websites
.be4,322 websites
.pl3,733 websites
.it3,477 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-5585

Top websites that are affected by CVE-2024-5585. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.********.it Italy*,***
*******.com Germany*,***
***************.org United States*,***
****.org United States*,***
***************.com Singapore*,***
***********.com United States*,***
******************.com Singapore*,***
************.jp Japan*,***
******.****.ru Russia*,***
********.*********.com Italy*,***
See full domain list

FAQ

CVE-2024-5585 is Improper Encoding or Escaping of Output in PHP
A total of 159,286 websites have been identified as vulnerable to CVE-2024-5585, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2024-5585 vulnerability.
PHP versions up to 8.3.8 are vulnerable to CVE-2024-5585.
CVE-2024-5585 is resolved in version 8.3.8 of PHP.