CVE-2012-1823criticalunder attackCWE-77

CVE-2012-1823

Published · Updated

Follow this CVE+ Monitor PHP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDMay 11
1st PoCMay 4
metasploitMay 3
CISA KEV+3605d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
15 products (1,896 components)
RHEL Desktop Workstation (v. 5 client) · Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux EUS (v. 5.6 server) · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux HPC Node (v. 6) · and others 10
fix ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 4
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

PHP-CGI fails to properly parse query strings without an equals sign, allowing attackers to inject command-line options that execute arbitrary code on the server.

Technical detail

CVE-2012-1823 affects PHP configured as CGI when processing query strings lacking an '=' character. The vulnerability stems from improper handling of the 'd' case in php_getopt, enabling remote attackers to inject arbitrary command-line options via malformed query strings, leading to arbitrary code execution with the privileges of the web server process.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 26✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29290exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/18836exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/18834exploitdbwww.exploit-db.com/exploits/29316unverifiedgithubgithub.com/0xl0k1/CVE-2012-1823★ 12githubgithub.com/Unix13/metasploitable2★ 4githubgithub.com/tardummy01/oscp_scripts-1★ 3githubgithub.com/mujtaba815/metasploitable2-php-cgi-exploit★ 3githubgithub.com/cyberharsh/PHP_CVE-2012-1823★ 1githubgithub.com/drone789/CVE-2012-1823★ 1githubgithub.com/Dmitri131313/CVE-2012-1823-exploit-for-https-user-password-web★ 1githubgithub.com/hackherMind-Pixel/Vulnerable-Lab-Exploitation★ 1githubgithub.com/CyberCTF/vulhub-php-cve-2012-1823★ 0githubgithub.com/nulltrace1336/PHP-CGI-Argument-Injection-Exploit★ 0githubgithub.com/K3ysTr0K3R/CVE-2012-1823★ 0githubgithub.com/Jimmy01240397/CVE-2012-1823-Analyze★ 0githubgithub.com/yilmaz8596/metasploitable-vulnerability-assessment★ 0githubgithub.com/waburig/Open-Worldwide-Application-Security-Project-OWASP-★ 0githubgithub.com/mehedi-hasan-sami98/DVWA-ZAP-PENTEST★ 0githubgithub.com/tanasescualexandrugabriel/Vulnerability-Assessment-and-OSINT-CVE-2012-1823★ 0githubgithub.com/tryj/CVE-2012-1823---PHP-CGI---RCE★ 0vulncheckvulncheck.com/xdb/6743a3a1bbe1unverifiedvulncheckvulncheck.com/xdb/67d4003e8705unverifiedvulncheckvulncheck.com/xdb/bc79679e68c9unverifiedvulncheckvulncheck.com/xdb/fee31699b339unverifiedvulncheckvulncheck.com/xdb/4c4b58f1b43funverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.