CVE-2004-0542

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.idefense.com/application/poi/display?id=108Not Applicable
http://www.php.net/release_4_3_7.phpPatch, Release Notes, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16331Third Party Advisory, VDB Entry
http://www.idefense.com/application/poi/display?id=108Not Applicable
http://www.php.net/release_4_3_7.phpPatch, Release Notes, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16331Third Party Advisory, VDB Entry

Timeline

Published: Aug 6, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-054310.0Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers CVE-2004-05447.2Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the (1) putlvcb or (2) getlvcb commands.CVE-2004-05457.2LVM for AIX 5.1 and 5.2 allows local users to overwrite arbitrary files via a symlink attack.CVE-2004-05475.0Buffer overflow in the ODBC driver for PostgreSQL before 7.2.1 allows remote attackers to cause a denial of service (crash).CVE-2004-05487.2Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrar CVE-2004-054910.0The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attac CVE-2004-05507.5Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of "." (perio CVE-2004-05515.0Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a den CVE-2004-05527.5Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1 CVE-2004-05542.1Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that trig CVE-2004-05557.5Buffer overflow in (1) queue.c and (2) queued.c in queue before 1.30.1 may allow remote attackers to execute arbitrary code.CVE-2004-055710.0Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers t