medium5.0Public exploit code

CVE-2012-2336

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lac…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution2013-10-29 · remote · php · Verified
PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection2012-05-05 · remote · php · Verified
PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)2012-05-04 · remote · php · Verified
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner2013-10-31 · remote · php

Impact

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

Affected products

Vendor	Product	Affected versions
Php	Php	through 5.3.12 Versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1

Weakness classification

CWE-20

Public exploit code

Impact

Affected products

Weakness classification

References