Vulnerability Details : CVE-2012-1823
Public exploit exists!
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Vulnerability category: Input validationExecute code
Threat overview for CVE-2012-1823
Top countries where our scanners detected CVE-2012-1823
Top open port discovered on systems with this issue
80
IPs affected by CVE-2012-1823 205,048
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-1823!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
CVE-2012-1823 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
PHP-CGI Query String Parameter Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Added on
2022-03-25
Action due date
2022-04-15
Exploit prediction scoring system (EPSS) score for CVE-2012-1823
Probability of exploitation activity in the next 30 days: 97.41%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2012-1823
-
PHP CGI Argument Injection
Disclosure Date: 2012-05-03First seen: 2020-04-26exploit/multi/http/php_cgi_arg_injectionWhen run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in t
CVSS scores for CVE-2012-1823
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2012-1823
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1823
-
http://rhn.redhat.com/errata/RHSA-2012-0569.html
RHSA-2012:0569 - Security Advisory - Red Hat Customer Portal
-
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
Apple - Lists.apple.com
-
http://rhn.redhat.com/errata/RHSA-2012-0570.html
RHSA-2012:0570 - Security Advisory - Red Hat Customer Portal
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
-
http://www.securitytracker.com/id?1027022
PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code - SecurityTracker
-
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html
[security-announce] SUSE-SU-2012:0598-1: critical: Security update for P
-
https://bugs.php.net/bug.php?id=61910
PHP :: Sec Bug #61910 :: VU#520827 - PHP-CGI query string parameter vulnerabilityExploit;Patch
-
http://rhn.redhat.com/errata/RHSA-2012-0568.html
RHSA-2012:0568 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
[security-announce] SUSE-SU-2012:0604-1: critical: Security update for P
-
http://www.php.net/archive/2012.php#id2012-05-03-1
PHP: News Archive - 2012
-
http://www.kb.cert.org/vuls/id/520827
VU#520827 - PHP-CGI query string parameter vulnerabilityExploit;US Government Resource
-
https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1
PHP :: Bug #61910 :: Patches
-
http://marc.info/?l=bugtraq&m=134012830914727&w=2
'[security bulletin] HPSBUX02791 SSRT100856 rev.1 - HP-UX Apache Web Server running PHP, Remote Execu' - MARC
-
http://rhn.redhat.com/errata/RHSA-2012-0547.html
RHSA-2012:0547 - Security Advisory - Red Hat Customer Portal
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068
mandriva.com
-
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
[security-announce] openSUSE-SU-2012:0590-1: critical: update for php5
-
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
Exploit
-
http://support.apple.com/kb/HT5501
About the security content of OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 - Apple Support
-
http://www.php.net/ChangeLog-5.php#5.4.2
PHP: PHP 5 ChangeLogExploit;Patch
-
http://www.kb.cert.org/vuls/id/673343
VU#673343 - Parallels Plesk Panel phppath/php vulnerabilityUS Government Resource
-
http://www.debian.org/security/2012/dsa-2465
Debian -- Security Information -- DSA-2465-1 php5
-
http://rhn.redhat.com/errata/RHSA-2012-0546.html
RHSA-2012:0546 - Security Advisory - Red Hat Customer Portal
Products affected by CVE-2012-1823
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:*