loading
Point hosts at PHP and flag CVE-2024-4577 by version. No confirm: a Best-Fit probe would execute PHP. Version and banner only. CISA KEV.
Targets
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Detect
Fingerprints PHP CGI and flags CVE-2024-4577 by version. No probe.
Collect
Merges per-host detect rows.
Report
Counts checked, product, and affected.
This workflow finds PHP on Windows CGI and sorts each host by whether its version falls in the CVE-2024-4577 range. CVE-2024-4577 is Windows Best-Fit mapping that turns a soft hyphen into a CGI flag, which becomes RCE. Confirming it would run php-cgi. This graph does not POST php://input and does not execute PHP. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from a public page or Server banner, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no confirm node. A Best-Fit probe would execute PHP, so detection stays version and banner, same honesty as NetScaler.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
url field also works. Point it at scope you are authorised to test.The records below are illustrative and do not come from a real run. They show one PHP host inside the CVE-2024-4577 range, one patched host, and one host that is not the product.
| target_url | product_detected | version | affected | error |
|---|---|---|---|---|
| https://app.example.com | true | 8.3.7 | true | null |
| https://app.example.org | true | 8.3.8 | false | null |
| https://shop.example.net | false | null | false | not_product |
{"cve": "CVE-2024-4577", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}PHP 8.3 before 8.3.8, 8.2 before 8.2.20, and 8.1 before 8.1.29, on Windows CGI. 8.3.8, 8.2.20, and 8.1.29 are the floors. The compare uses the version the product itself served.
CVE-2024-4577 is CGI argument injection. The public probe would execute PHP. There is no non-intrusive probe. The DAG stays targets, check, collect, summary.
No. A flagged row is patch-lag against the range table. The run does not POST php://input. Treat it as a patching signal.
Yes. It only sends read-only GET requests. It does not log in and it does not execute PHP.
No. It fingerprints the public page the way an external scanner would.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.