VulnerabilityAnalyzed
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
KEVCRITICAL 9.8EPSS 100.0%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 100.00% probability · 100th percentile
- CISA KEV
- Listed 25 March 2022 · due 15 April 2022
- Weakness
- CWE-77
- Affected
- php/php · fedoraproject/fedora · debian/debian linux · hp/hp-ux · opensuse/opensuse · suse/linux enterprise server · suse/linux enterprise software development kit · apple/mac os x · redhat/application stack · redhat/gluster storage server for on-premise · redhat/storage · redhat/storage for public cloud · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation
- Source
- cret@cert.org
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-1823
References
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/Broken Link, Exploit
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041Broken Link
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134012830914727&w=2Mailing List
- http://rhn.redhat.com/errata/RHSA-2012-0546.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0547.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0568.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0569.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0570.htmlThird Party Advisory
- http://secunia.com/advisories/49014Broken Link
- http://secunia.com/advisories/49065Broken Link
- http://secunia.com/advisories/49085Broken Link
- http://secunia.com/advisories/49087Broken Link
- http://support.apple.com/kb/HT5501Third Party Advisory
- http://www.debian.org/security/2012/dsa-2465Third Party Advisory
- http://www.kb.cert.org/vuls/id/520827Exploit, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/673343Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:068Broken Link
- http://www.openwall.com/lists/oss-security/2024/06/07/1Mailing List
- http://www.php.net/ChangeLog-5.php#5.4.2Exploit, Patch, Release Notes
- http://www.php.net/archive/2012.php#id2012-05-03-1Release Notes
- http://www.securitytracker.com/id?1027022Broken Link, Third Party Advisory, VDB Entry
- https://bugs.php.net/bug.php?id=61910Exploit, Patch
- https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1Patch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/Mailing List, Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/Mailing List, Release Notes
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/Broken Link, Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.