pvl_php2shell_vulnerability_audit
Summary
This table stores the PHP installations found by the PHP2Shell Vulnerability - Audit script and whether each one is affected by PHP2Shell. Each PHP installation on a computer is stored as one row. A computer without any PHP installation is stored as a single row with the status NotDetected, and its PHP-related columns are empty.
Dependencies
- Script: PHP2Shell Vulnerability - Audit
- Script: OverFlowedVariable - SQL Insert - Execute
- Solution: PHP2Shell Vulnerability Audit
Tables
pvl_php2shell_vulnerability_audit
| Column | Type | Explanation |
|---|---|---|
| ComputerId | INT | The Automate Computer ID of the agent. |
| Path | VARCHAR | The folder of the PHP installation. |
| Name | VARCHAR | The product that owns the installation: 'PHP' for a standalone installation, the stack name (e.g., 'XAMPP'), the bundling application, or 'Unknown application'. |
| Publisher | VARCHAR | The publisher of the owning product, when known. |
| IsNative | VARCHAR | 'True' for a standalone PHP installation, 'False' when PHP belongs to a stack or another vendor's product. |
| InstallType | VARCHAR | 'Standalone', 'Stack', or 'Vendor'. |
| ManagedBy | VARCHAR | 'Winget' for a winget installation for all users, 'Winget (user scope)' for a winget installation in a user profile, otherwise 'None'. |
| PackageId | VARCHAR | The winget package ID of a winget installation (e.g., 'PHP.PHP.NTS.8.3'). |
| ExecutablePath | VARCHAR | The PHP file the version was read from (php.exe, php-cgi.exe, or the PHP engine DLL). |
| Version | VARCHAR | The installed PHP version. After a successful update, the new version. |
| Architecture | VARCHAR | 'x64', 'x86', 'arm64', or 'Unknown'. |
| ThreadSafety | VARCHAR | 'TS' (thread safe), 'NTS' (non-thread safe), or 'Unknown'. |
| InIis | VARCHAR | 'True' when IIS uses the installation, otherwise 'False'. |
| Running | VARCHAR | 'True' when PHP from the installation was running during the audit, otherwise 'False'. |
| Status | VARCHAR | 'Patched', 'Vulnerable', 'EndOfLife', 'Unknown', or 'NotDetected' when the computer has no PHP installation. |
| RequiredVersion | VARCHAR | The first patched release for the installation's version line (e.g., '8.3.36'). |
| Action | TEXT | What the script did with the installation: 'None', updated, skipped with the reason, or failed with the reason. |
| ScriptRunTime | DATETIME | The timestamp of when the script executed and populated this record. |
Changelog
2026-10-23
- Initial version of the document.