Cloudanix VulnDB

CVE-2024-8925

None

CVSS

—

EPSS

0.9%

Published

Oct 8, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in PHP can cause websites to ignore some of the information people submit through online forms, letting attackers make the site behave incorrectly.

Chainable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Erroneous parsing of multipart form data in HTTP POST requests causes legitimate submitted fields to be dropped or skipped in PHP's form handling.

Why it matters to the business

Web applications may silently ignore portions of user input, leading to incomplete transactions, bypassed checks, or incorrect application state with low urgency given stable low EPSS and no KEV listing.

How an attack unfolds

An attacker submits a specially crafted multipart/form-data POST that exploits the parsing flaw to cause PHP to exclude other legitimate form fields, resulting in the application processing only attacker-controlled data.

How to fix it

Upgrade PHP to 8.1.30 or later, 8.2.24 or later, or 8.3.12 or later. For github.com/0xJacky/Nginx-UI upgrade to version 1.9.10-0.20231219184941-827e76c46e63 or later.

How to confirm the fix worked

Verify running PHP version meets or exceeds the fixed releases; test affected endpoints with known multipart payloads that previously caused field exclusion.

Typical attack path

  1. Identify a target running vulnerable PHP 8.1 < 8.1.30, 8.2 < 8.2.24 or 8.3 < 8.3.12
  2. Craft a multipart POST request that triggers the parsing error
  3. Submit the request to an application endpoint that consumes form data
  4. Observe or induce erroneous application behavior due to missing fields

How to detect it

Inspect web server and application logs for anomalous multipart POST requests that result in incomplete form processing; correlate with PHP version information.

What your security team should do

  • Apply the PHP version upgrades immediately across all web servers
  • Review and test all form-handling code paths after the upgrade
  • Monitor application logs for unexpected missing form field errors

The record

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 apcu-panel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 apcu-panel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-bcmath 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-bcmath 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-cli 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-cli 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-common 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-common 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dba 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dba 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dbg 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dbg 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-devel 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-devel 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-embedded 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-embedded 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-enchant 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-enchant 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ffi 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ffi 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-fpm 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-fpm 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-intl 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-intl 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-json 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ldap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ldap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mbstring 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mbstring 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mysqlnd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mysqlnd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-odbc 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-odbc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-opcache 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-opcache 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pdo 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pdo 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pear 0 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pear 0 1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+3059+d65eee13
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pecl-xdebug3 0 3.2.2-2.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.22.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pgsql 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pgsql 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-process 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-process 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-snmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-snmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-soap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-soap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xml 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-xml 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xmlrpc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:9 apcu-panel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 apcu-panel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-bcmath 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-bcmath 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-cli 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-cli 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-common 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-common 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dba 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dba 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dbg 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dbg 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-devel 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-devel 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-embedded 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-embedded 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-enchant 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-enchant 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ffi 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ffi 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-fpm 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-fpm 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-intl 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-intl 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ldap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ldap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mbstring 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mbstring 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mysqlnd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mysqlnd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-odbc 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-odbc 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-opcache 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-opcache 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pdo 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pdo 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pecl-apcu 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.2.2-2.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.1.4-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-zip 0 1.22.3-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-zip 0 1.20.1-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pgsql 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pgsql 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-process 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-process 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-snmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-snmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-soap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-soap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-xml 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-xml 0 8.1.30-1.module_el9.5.0+131+62ecd687
Bitnami libphp 0 8.1.30
Bitnami php 0 8.1.30
Bitnami php-min 0 8.1.30
Chainguard php-8.1 0 8.1.30-r0
Chainguard php-8.1-apache 0 8.1.30-r0
Chainguard php-8.1-bcmath 0 8.1.30-r0
Chainguard php-8.1-bcmath-config 0 8.1.30-r0
Chainguard php-8.1-bz2 0 8.1.30-r0
Chainguard php-8.1-bz2-config 0 8.1.30-r0
Chainguard php-8.1-calendar 0 8.1.30-r0
Chainguard php-8.1-calendar-config 0 8.1.30-r0
Chainguard php-8.1-cgi 0 8.1.30-r0
Chainguard php-8.1-config 0 8.1.30-r0
Chainguard php-8.1-ctype 0 8.1.30-r0
Chainguard php-8.1-ctype-config 0 8.1.30-r0
Chainguard php-8.1-curl 0 8.1.30-r0
Chainguard php-8.1-curl-config 0 8.1.30-r0
Chainguard php-8.1-dbg 0 8.1.30-r0
Chainguard php-8.1-dev 0 8.1.30-r0
Chainguard php-8.1-doc 0 8.1.30-r0
Chainguard php-8.1-dom 0 8.1.30-r0
Chainguard php-8.1-dom-config 0 8.1.30-r0
Chainguard php-8.1-exif 0 8.1.30-r0
Chainguard php-8.1-exif-config 0 8.1.30-r0
Chainguard php-8.1-fileinfo 0 8.1.30-r0
Chainguard php-8.1-fileinfo-config 0 8.1.30-r0
Chainguard php-8.1-fpm 0 8.1.30-r0
Chainguard php-8.1-fpm-config 0 8.1.30-r0
Chainguard php-8.1-ftp 0 8.1.30-r0
Chainguard php-8.1-ftp-config 0 8.1.30-r0
Chainguard php-8.1-gd 0 8.1.30-r0
Chainguard php-8.1-gd-config 0 8.1.30-r0
Chainguard php-8.1-gettext 0 8.1.30-r0
Chainguard php-8.1-gettext-config 0 8.1.30-r0
Chainguard php-8.1-gmp 0 8.1.30-r0
Chainguard php-8.1-gmp-config 0 8.1.30-r0
Chainguard php-8.1-iconv 0 8.1.30-r0
Chainguard php-8.1-iconv-config 0 8.1.30-r0
Chainguard php-8.1-intl 0 8.1.30-r0
Chainguard php-8.1-intl-config 0 8.1.30-r0
Chainguard php-8.1-ldap 0 8.1.30-r0
Chainguard php-8.1-ldap-config 0 8.1.30-r0
Chainguard php-8.1-mbstring 0 8.1.30-r0
Chainguard php-8.1-mbstring-config 0 8.1.30-r0
Chainguard php-8.1-mysqli 0 8.1.30-r0
Chainguard php-8.1-mysqli-config 0 8.1.30-r0
Chainguard php-8.1-mysqlnd 0 8.1.30-r0
Chainguard php-8.1-mysqlnd-config 0 8.1.30-r0

Related vulnerabilities