Saturday , April 19 2025
PHP

Critical PHP Zero-Day Vulnerability found in Craft CMS To Gain RCE

A major security flaw in Craft CMS, a popular PHP content management system, has been found, enabling unauthenticated remote code execution (RCE) with default settings.

The vulnerability CVE-2024-56145 was reported by security researchers and quickly patched by the Craft CMS team within 24 hours.

CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers

Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
CVE-2025-2492  ASUS warns of critical auth bypass flaw in routers

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
16,000+  Fortinet devices compromised with symlink backdoor, Mostly in Asia

Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

CISA warns of increasing risk tied to Oracle legacy Cloud leak

On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
CISA warns of increasing risk tied to Oracle legacy Cloud leak

CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App

Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
CVE-2025-20236  Cisco Patches Unauthenticated RCE Flaw in Webex App

Apple released emergency security updates for 2 zero-day vulns

On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
Apple released emergency security updates for 2 zero-day vulns

Oracle Released Patched for 378 flaws for April 2025

On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
Oracle Released Patched for 378 flaws for April 2025

CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild

Check Point Research warns of the active exploitation of a new vulnerability, CVE-2025-24054, which lets hackers leak NTLMv2-SSP hashes using...
Read More
CVE-2025-24054  Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild

Bengaluru firm got ransomware attack, Hacker demanded $70,000

Bengaluru's Whiteboard Technologies Pvt Ltd was hit by a ransomware attack, with hackers demanding a ransom of up to $70,000...
Read More
Bengaluru firm got ransomware attack, Hacker demanded $70,000

MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today

MITRE Vice President Yosry Barsoum warned that U.S. government funding for the Common Vulnerabilities and Exposures (CVE) and Common Weakness...
Read More
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today

PHP has improved over the years but still faces security challenges. While older vulnerabilities like register_globals and magic_quotes_gpc are resolved, some design quirks can cause critical issues.

The recent flaw in Craft CMS shows how ordinary PHP behaviors can lead to security vulnerabilities.

At the heart of this vulnerability is the register_argc_argv configuration setting in PHP. This setting controls if command-line arguments ($_SERVER[‘argc’] and $_SERVER[‘argv’]) are available when a script runs.

In PHP, the register_argc_argv option is enabled by default, which can cause issues when query strings are used in web-hosted scripts. The official Craft CMS Docker image has this setting enabled, making it potentially vulnerable.

How the Vulnerability Works:

The issue with Craft CMS is in its handling of command-line options during startup. Developers found that query strings can manipulate paths for important files, such as configuration files and templates.

Attackers could exploit this behavior to control file paths and execute arbitrary code.

Researchers showed that using an ftp:// link to host malicious templates on an FTP server allowed them to bypass security checks and inject harmful code into a vulnerable Craft CMS.

Adam Kues found that Craft CMS’s attempt to secure its template engine (Twig) wasn’t foolproof. Attackers could use tricks like the sort filter combined with call_user_func to bypass these security measures and execute remote code.

Impact and Mitigation:

Craft CMS is used by over 150,000 websites worldwide, including major enterprises. A vulnerability risked organizations using the platform’s default settings.

The Craft CMS team quickly released patched versions 5.5.2+ and 4.13.2+. Users should upgrade their installations right away. Full report here.

Check Also

FortiGate Firewall

Hackers Allegedly Advertise To Sell FortiGate Firewall 0-Day Exploit

A threat actor is reportedly advertised to sell a zero-day exploit for Fortinet’s FortiGate firewalls …

Leave a Reply

Your email address will not be published. Required fields are marked *