NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Affected products

VendorProductAffected versions
PhpPhp
before 5.3.12
from 5.4.0 before 5.4.2
FedoraprojectFedora
Versions 39, 40
DebianDebian Linux
Version 6.0
HpHp-Ux
Versions b.11.23, b.11.31
OpensuseOpensuse
Versions 11.4, 12.1
SuseLinux Enterprise Server
Versions 10, 11
SuseLinux Enterprise Software Development Kit
Versions 10, 11
AppleMac Os X
from 10.6.8 before 10.7.5
from 10.8.0 before 10.8.2
RedhatApplication Stack
Version 2.0
RedhatGluster Storage Server For On-Premise
Version 2.0
RedhatStorage
Version 2.0
RedhatStorage For Public Cloud
Version 2.0

Weakness classification

CWE-77

References