CVE-2004-2692

N/A Unknown

Published: December 31, 2004 Modified: April 16, 2026

Description

The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://kyberdigi.cz/projects/execdir/english.html

Source: cve@mitre.org

Patch

http://seclists.org/fulldisclosure/2004/Jul/0347.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2004/Jul/0350.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2004/Jul/0357.html

Source: cve@mitre.org

http://secunia.com/advisories/11928

Source: cve@mitre.org

Vendor Advisory

http://www.osvdb.org/7243

Source: cve@mitre.org

http://www.securityfocus.com/bid/10598

Source: cve@mitre.org

Exploit Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/16498

Source: cve@mitre.org

http://kyberdigi.cz/projects/execdir/english.html