PT-2012-1212 · Php+4 · Php+4
Nielsdos
·
Publicado
2011-12-05
·
Atualizado
2026-03-10
·
CVE-2012-1823
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.3.12
PHP versions 5.4.x prior to 5.4.2
Description
The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code by placing command-line options in the query string, specifically when the query string lacks an equals sign character. The vulnerability is related to the lack of skipping a certain php getopt for the 'd' case.
Recommendations
For PHP versions prior to 5.3.12, update to version 5.3.12 or later.
For PHP versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later.
As a temporary workaround, consider restricting access to the CGI script to minimize the risk of exploitation.
Exploit
Correção
RCE
SQL injection
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Hp-Ux
Php
Red Hat
Suse