Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

CriticalExploitation confirmedCISA KEV
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run PHP, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Apr 15, 2022.

Patch status

Official fix available since

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
PHPPHP< 5.3.12; >= 5.4.0, < 5.4.25.3.12; 5.4.2KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2012-1823 scored CVSS 9.8: PHP PHP, PHP-CGI Query String Parameter Vulnerability

    CISA lists this as exploited in the wild. Unpatched PHP systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

  2. Patch releasedUpdateKEV

    Patch released for CVE-2012-1823: PHP PHP, PHP-CGI Query String Parameter Vulnerability

    An official fix is now available for PHP PHP. This vulnerability is being exploited, so apply it promptly.

    Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References