CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 100.00% probability · 100th percentile
- Public exploits
- 4 in Exploit-DB · verified · first 4 May 2012
- CISA KEV
- Listed 25 March 2022 · due 15 April 2022
- Weakness
- CWE-77
- Affected
- php/php · fedoraproject/fedora · debian/debian linux · hp/hp-ux · opensuse/opensuse · suse/linux enterprise server · suse/linux enterprise software development kit · apple/mac os x · redhat/application stack · redhat/gluster storage server for on-premise · redhat/storage · redhat/storage for public cloud · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation
- Source
- cret@cert.org
EPSS 100.0% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-1823
Public exploits (4)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-29316source ↗ | Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scannerphp · noptrix | remote | 31 October 2013 | no |
| EDB-29290source ↗ | Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Executionphp · kingcope | remote | 29 October 2013 | yes |
| EDB-18836source ↗ | PHP < 5.3.12 / < 5.4.2 - CGI Argument Injectionphp · rayh4c | remote | 5 May 2012 | yes |
| EDB-18834source ↗ | PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)php · Metasploit | remote | 4 May 2012 | yes |
References
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/Broken Link, Exploit
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041Broken Link
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134012830914727&w=2Mailing List
- http://rhn.redhat.com/errata/RHSA-2012-0546.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0547.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0568.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0569.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0570.htmlThird Party Advisory
- http://secunia.com/advisories/49014Broken Link
- http://secunia.com/advisories/49065Broken Link
- http://secunia.com/advisories/49085Broken Link
- http://secunia.com/advisories/49087Broken Link
- http://support.apple.com/kb/HT5501Third Party Advisory
- http://www.debian.org/security/2012/dsa-2465Third Party Advisory
- http://www.kb.cert.org/vuls/id/520827Exploit, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/673343Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:068Broken Link
- http://www.openwall.com/lists/oss-security/2024/06/07/1Mailing List
- http://www.php.net/ChangeLog-5.php#5.4.2Exploit, Patch, Release Notes
- http://www.php.net/archive/2012.php#id2012-05-03-1Release Notes
- http://www.securitytracker.com/id?1027022Broken Link, Third Party Advisory, VDB Entry
- https://bugs.php.net/bug.php?id=61910Exploit, Patch
- https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1Patch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/Mailing List, Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/Mailing List, Release Notes
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/Broken Link, Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.