PT-2012-1212 · Php+4 · Php+4
Nielsdos
·
Published
2011-12-05
·
Updated
2026-03-10
·
CVE-2012-1823
CVSS v2.0
7.5
High
| AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.3.12
PHP versions 5.4.x prior to 5.4.2
Description
The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code by placing command-line options in the query string, specifically when the query string lacks an equals sign character. The vulnerability is related to the lack of skipping a certain php getopt for the 'd' case.
Recommendations
For PHP versions prior to 5.3.12, update to version 5.3.12 or later.
For PHP versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later.
As a temporary workaround, consider restricting access to the CGI script to minimize the risk of exploitation.
Exploit
Fix
RCE
Command Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Hp-Ux
Php
Red Hat
Suse