CVE-2012-1823

Advisory lineage Upstream: 0 Downstream: 9
Analyzed
Published: 11 May 2012, 10:00
Last modified:04 Nov 2025, 17:11

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
94.36% CRITICAL
94% probability -0.02%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
9 found
Dark Web
Not detected

Timeline

11 May 2012, 10:00
Published
Vulnerability first disclosed
25 Mar 2022, 00:00
Added to CISA KEV
PHP-CGI Query String Parameter Vulnerability
15 Apr 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
04 Nov 2025, 17:11
Last Modified
Vulnerability information updated

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 94.36%• Percentile: 100%

Techniques & Countermeasures

  • CWE-77•Improper Neutralization of Special Elements used in a Command ('Command Injection')

    The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Systems

  • apple•mac_os_x

    ≥ 10.6.8, < 10.7.5 | ≥ 10.8.0, < 10.8.2

  • debian•debian_linux

    6.0

  • fedoraproject•fedora

    39 | 40

  • hp•hp-ux

    b.11.23 | b.11.31

  • opensuse•opensuse

    11.4 | 12.1

  • Unknown•PHP

    < 5.3.12 | ≥ 5.4.0, < 5.4.2

  • redhat•application_stack

    2.0

  • redhat•enterprise_linux_desktop

    6.0

  • redhat•enterprise_linux_eus

    5.6 | 6.1 | 6.2

  • redhat•enterprise_linux_server

    5.0 | 6.0

  • redhat•enterprise_linux_server_aus

    5.3 | 5.6

  • redhat•enterprise_linux_workstation

    5.0 | 6.0

  • redhat•gluster_storage_server_for_on-premise

    2.0

  • redhat•storage

    2.0

  • redhat•storage_for_public_cloud

    2.0

  • suse•linux_enterprise_server

    10:sp4 | 11:sp2

  • suse•linux_enterprise_software_development_kit

    10:sp4 | 11:sp2

References (31)