JVNDB-2015-000101

PHP for Windows vulnerable to OS command injection

PHP for Windows contains an OS command injection due to a processing flaw in the escapeshellarg function.

Masahiro Yamada reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

The PHP Group

• PHP for Windows versions prior to 5.4.42
• PHP for Windows versions prior to 5.5.26
• PHP for Windows versions prior to 5.6.10

Specifying a specially crafted parameter in the escapeshellarg function may result in an arbitrary OS command being executed.

[Apply the patch]
Apply the patch according to the infomration provided by the developer.

The PHP Group

• PHP : Sec Bug #69646 OS command injection vulnerability in escapeshellarg
• PHP : PHP ChangeLog 5.6.10
• PHP : PHP ChangeLog 5.5.26
• PHP : PHP ChangeLog 5.4.42
• The PHP Group : Fix bug #69646 OS command injection vulnerability in escapeshellarg

Turbolinux, Inc.

• Turbolinux Security Advisory : TLSA-2015-15 (in Japanese)

1. OS Command Injection(CWE-78) [IPA Evaluation]

1. CVE-2015-4642

1. JVN : JVN#73568461
2. National Vulnerability Database (NVD) : CVE-2015-4642
3. IPA SECURITY ALERTS : Security Alert for Vulnerability in PHP for Windows (JVN#73568461) (in Japanese)

• [2015/07/17]
    Web page was published
  [2015/07/22]
    References : Content was added
  [2015/07/30]
    Vendor Information : Content was added
  [2016/05/19]
    References : Content was added
    Vendor Information : Content was added