CVSS is an imperfect system. Most of the time it gets the idea of how severe an issue is across, but once you go above an 8, maybe an 8.5, there are some perverse incentives at play. Even with newer versions of the framework coming out over the years, there have always been gaps.
Even before AI, there was prestige in being able to say that you (or your team) found a 9.2 in some major piece of software. You could put that on your resume in some specializations.
Now with AI vulnerability scanning being so hyper-commercialized (but not yet fully commoditized), this is cranked way up since there are more monied interests involved, and many of them are probably trying to make a quick buck before LLM-based vulnerability scans are a commodity (for better or worse).
The PHP CVS were originally reported as perfect 10s and in theory allow remote access (practically all of the internet). This requires physical hardware access (practically 0 of the internet).
Those original PHP 10s were negotiated down into a 9.2 by disclosure.. so maybe this'll be an 8.7 soon.
Well because some php configurations had an absurdly low default max upload size, which made the rce way harder.
Plesk for example ships with 2m for some reason.
The fact that a subset of systems are in a less vulnerable configuration doesn't have any bearing on the CVSS score.
> Specific configurations should not impact any attribute contributing to the CVSS Base metric assessment , i.e., if a specific configuration is required for an attack to succeed, the vulnerable system should be assessed assuming it is in that configuration. [1]
For a vulnerability to score a 10 its Attack Complexity must be 'Low' (broadly speaking: it doesn't require target-specific customizations or mitigations [1]), which isn't the case with php2shell.
