The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php-exec-dir | Kyberdigi_labs | 4.3.2 (including) | 4.3.2 (including) |
| Php-exec-dir | Kyberdigi_labs | 4.3.3 (including) | 4.3.3 (including) |
| Php-exec-dir | Kyberdigi_labs | 4.3.4 (including) | 4.3.4 (including) |
| Php-exec-dir | Kyberdigi_labs | 4.3.5 (including) | 4.3.5 (including) |
| Php-exec-dir | Kyberdigi_labs | 4.3.6 (including) | 4.3.6 (including) |
| Php-exec-dir | Kyberdigi_labs | 4.3.7 (including) | 4.3.7 (including) |