CVEs / CVE-2012-1823
CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability
- Known exploited in the CISA KEV catalog since 25 Mar 2022
- high 7.5 CVSS 2.0 (NVD)
- EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2012-1823
Summary
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 25 Mar 2022 |
|---|---|
| Due date for US federal agencies | 15 Apr 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 2.0 | 7.5 highAV:N/AC:L/Au:N/C:P/I:P/A:PScored by NVD |
|---|---|
| Weakness | CWE-77 |
References
- CVE-2012-1823 on NVD
- CVE-2012-1823 in the CISA KEV catalog
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ Broken Link, Exploit
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 Broken Link
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=134012830914727&w=2 Mailing List
- http://rhn.redhat.com/errata/RHSA-2012-0546.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0547.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0568.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0569.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0570.html Third Party Advisory
- http://secunia.com/advisories/49014 Broken Link
- http://secunia.com/advisories/49065 Broken Link
- http://secunia.com/advisories/49085 Broken Link
- http://secunia.com/advisories/49087 Broken Link
- http://support.apple.com/kb/HT5501 Third Party Advisory
- http://www.debian.org/security/2012/dsa-2465 Third Party Advisory
- http://www.kb.cert.org/vuls/id/520827 Exploit, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/673343 Third Party Advisory, US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.