CVE-2012-1823 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which all...
HighCVSS 7.5
EPSS 100.0%
CISA KEV
added 2022-03-25 · due 2022-04-15
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-25
- Due date (FCEB)
- 2022-04-15
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.3.12 | 5.3.12 |
| PHP | >= 5.4.0, < 5.4.2 | 5.4.2 |
| fedoraproject fedora | = 39 | No fix listed |
| fedoraproject fedora | = 40 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| HP Inc hp-ux | = b.11.23 | No fix listed |
| HP Inc hp-ux | = b.11.31 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.1 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise software development kit | = 10-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp2 | No fix listed |
| apple mac os x | >= 10.6.8, < 10.7.5 | 10.7.5 |
| apple mac os x | >= 10.8.0, < 10.8.2 | 10.8.2 |
| redhat application stack | = 2.0 | No fix listed |
| redhat gluster storage server for on-premise | = 2.0 | No fix listed |
| redhat storage | = 2.0 | No fix listed |
| redhat storage for public cloud | = 2.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 5.6 | No fix listed |
| redhat enterprise linux eus | = 6.1 | No fix listed |
| redhat enterprise linux eus | = 6.2 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server aus | = 5.3 | No fix listed |
| redhat enterprise linux server aus | = 5.6 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- eindbazen.net broken-link exploit
- HPSBMU02786 broken-link vendor-advisory
- APPLE-SA-2012-09-19-2 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2012:0590 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2012:0598 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2012:0604 mailing-list third-party-advisory vendor-advisory
- SSRT100856 mailing-list vendor-advisory
- RHSA-2012:0546 third-party-advisory vendor-advisory
- RHSA-2012:0547 third-party-advisory vendor-advisory
- RHSA-2012:0568 third-party-advisory vendor-advisory
- RHSA-2012:0569 third-party-advisory vendor-advisory
- RHSA-2012:0570 third-party-advisory vendor-advisory
- 49014 broken-link third-party-advisory
- 49065 broken-link third-party-advisory
- 49085 broken-link third-party-advisory
- 49087 broken-link third-party-advisory
- support.apple.com third-party-advisory
- DSA-2465 third-party-advisory vendor-advisory
- VU#520827 exploit third-party-advisory us-government-resource
- VU#673343 third-party-advisory us-government-resource
- MDVSA-2012:068 broken-link vendor-advisory
- [oss-security] 20240606 PHP security releases 8.3.8, 8.2.20, and 8.1.29 mailing-list
- www.php.net exploit patch release-notes
- www.php.net release-notes
- 1027022 broken-link third-party-advisory vdb-entry
- bugs.php.net exploit patch
- bugs.php.net patch
- FEDORA-2024-49aba7b305 mailing-list release-notes vendor-advisory
- FEDORA-2024-52c23ef1ec mailing-list release-notes vendor-advisory
- lists.fedoraproject.org mailing-list release-notes
- www.cisa.gov government-resource us-government-resource