How register_argc_argv affects non-CLI SAPI environments

I noticed a vulnerability in Laravel where "environment variables can be manipulated via query parameters when register_argc_argv = on," which piqued my interest, so I investigated it.
https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h

According to the official documentation, register_argc_argv is described as follows:

Tells PHP whether to declare the argv & argc variables (that would contain the GET information)

Looking at $_SERVER['argv']:

When called via the GET method, this will contain the query string.

This means that in non-CLI environments where register_argc_argv = on, the query string is treated as arguments.

If logic that reads argv can be triggered externally, this behavior can be used to pass arbitrary arguments. Several other projects were also affected.

• Cacti: CVE-2024-29895
• Laravel: CVE-2024-52301
• Symphony: CVE-2024-50340

Reference: Cacti's POC