Servers and applications
CVE-2004-0542
PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.
- Severity
- High 10.0
- Published
- 6 Aug 2004
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 14 Oct 2026
- Fixed in
- 4.3.7
- Exploit chance
- 31% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Over the network · No login needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
PHPServers and applications · cpe:a:php:php |
|