**Name of the Vulnerable Software and Affected Versions**

PHP versions prior to 5.3.12

PHP versions 5.4.x prior to 5.4.2

**Description**

The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code by placing command-line options in the query string, specifically when the query string lacks an equals sign character. The vulnerability is related to the lack of skipping a certain php getopt for the 'd' case.

**Recommendations**

For PHP versions prior to 5.3.12, update to version 5.3.12 or later.

For PHP versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later.

As a temporary workaround, consider restricting access to the CGI script to minimize the risk of exploitation.