From d7531ef74c448c2fe2ce06336c7e4792f2dee4db Mon Sep 17 00:00:00 2001 From: Stephen Fewer <122022313+sfewer-r7@users.noreply.github.com> Date: Thu, 13 Jun 2024 15:09:56 +0100 Subject: [PATCH] fix typo in documentation Co-authored-by: jheysel-r7 --- .../windows/http/php_cgi_arg_injection_rce_cve_2024_4577.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.md b/documentation/modules/exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.md index 7d74e42d2b..fe1e1cf734 100644 --- a/documentation/modules/exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.md +++ b/documentation/modules/exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.md @@ -2,7 +2,7 @@ This module exploits a PHP CGI argument injection vulnerability affecting PHP in certain configurations on a Windows target. A vulnerable configuration is locale dependant (such as Chinese or Japanese), such that the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen (0xAD) into a dash (0x2D) -character. Additionally a target web server bust be configured to run PHP under CGI mode, or directly expose +character. Additionally a target web server must be configured to run PHP under CGI mode, or directly expose the PHP binary. This issue has been fixed in PHP 8.3.8 (for the 8.3.x branch), 8.2.20 (for the 8.2.x branch), and 8.1.29 (for the 8.1.x branch). PHP 8.0.x and below are end of life and have note received patches.