CVE‑2019‑11043: PHP Remote Code Execution Exploit | Qualys
Summary: CVE-2019-11043 is a remote code execution flaw in PHP 7 versions below 7.1.33, 7.2.24 and 7.3.11, affecting only NGINX servers with PHP-FPM enabled, where crafted requests can cause the FPM module to write past allocated buffers and execute system commands. Qualys research traced the flaw to code in fpm_main.c and the fastcgi_split_path_info directive, with discovery credited to Wallarm researcher Andrew Danau during a September 14-16, 2019 CTF and wider attention following an October 22 tweet from Omar 'Beched' Ganiev.
Bottom line: The exploit is simple enough that Qualys advises upgrading all vulnerable PHP installations immediately, and an attacker who infects a worker can trigger command execution through any short-named query-string parameter such as 'a' or 'z'.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-11043
- Related
- CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026