CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability

KEV

Analyzed

AliasesRHSA-2012:0546RHSA-2012:0547RHSA-2012:0568+2 more

Published 11-05-2012Last modified 04-11-2025

Vulnerability summary

CVE-2012-1823 is a critical (CVSS 9.8) vulnerability in PHP. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (25-03-2022)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits9reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

DSA-2465-1 OPENSUSE-SU-2024:10290-1 OPENSUSE-SU-2024:10344-1 OPENSUSE-SU-2024:11169-1

Timeline

11-05-2012
PublishedVulnerability first disclosed.
25-03-2022
Added to CISA KEVExploitedPHP-CGI Query String Parameter Vulnerability
15-04-2022
CISA remediation dueDeadline passedApply updates per vendor instructions.
04-11-2025
Last modifiedVulnerability information updated.

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2012-1823

Public exploits

9 found

referenceUnverified
Exploit Reference (php.net)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown
referenceUnverified
Exploit Reference (eindbazen.net)
Maturity: unknown

Show all 9 exploits

referenceUnverified
Exploit Reference (kb.cert.org)
Maturity: unknown
exploit-databaseremotephpVerified
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution
Maturity: weaponized
exploit-databaseremotephpUnverified
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner
Maturity: poc
exploit-databaseremotephpVerified
PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)
Maturity: weaponized
exploit-databaseremotephpVerified
PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
Maturity: weaponized
MetasploitremoteVerified
PHP CGI Argument Injection
exploit/multi/http/php_cgi_arg_injection
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat59 products

enterprise_linux_workstation5.0 | 6.0
gluster_storage_server_for_on-premise2.0
storage2.0
storage_for_public_cloud2.0
php< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-bcmath< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-cli< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-common< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-dba< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-debuginfo< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-devel< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-embedded< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-enchant< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-gd< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-imap< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-intl< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-ldap< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-mbstring< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-mysql< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-ncurses< 0:5.1.6-34.el5_8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.2.10-2.el5s2
php-odbc< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-pdo< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-pgsql< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-process< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-pspell< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-recode< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-snmp< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-soap< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-tidy< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php-xml< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-xmlrpc< 0:5.1.6-34.el5_8 | < 0:5.3.3-3.el6_2.8 | < 0:5.1.6-23.3.el5_3 | < 0:5.1.6-27.el5_6.4 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4 | < 0:5.2.10-2.el5s2
php-zts< 0:5.3.3-3.el6_2.8 | < 0:5.3.2-6.el6_0.2 | < 0:5.3.3-3.el6_1.4
php53< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-bcmath< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-cli< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-common< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-dba< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-debuginfo< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-devel< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-gd< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-imap< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-intl< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-ldap< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-mbstring< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-mysql< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-odbc< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-pdo< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-pgsql< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-process< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-pspell< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-snmp< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-soap< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-xml< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2
php53-xmlrpc< 0:5.3.3-7.el5_8 | < 0:5.3.3-1.el5_6.2