CVE-2015-4642
CriticalSummary
The escapeshellarg function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized commands on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and review application code to secure against similar attacks.
Original NVD description (English source)
The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.