Skip to content
Fencer Intel
critical 9.8

CVE-2012-1823 kev in the critical feed json

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle qu…

published 2012-05-11 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-1833

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-03-25
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
5
Metasploit, Exploit-DB, plus a Nuclei check

Summary

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • php php 5.3.12, 5.4.2
  • apple mac_os_x 10.7.5, 10.8.2
  • php RHEL 5 5.1.6-34.el5_8
  • php RHEL 6 5.3.3-3.el6_2.8
  • php-gd RHEL 5 5.1.6-34.el5_8
  • php-gd RHEL 6 5.3.3-3.el6_2.8
  • php-cli RHEL 5 5.1.6-34.el5_8
  • php-cli RHEL 6 5.3.3-3.el6_2.8
  • php-dba RHEL 5 5.1.6-34.el5_8
  • php-dba RHEL 6 5.3.3-3.el6_2.8

red hat advisories RHSA-2012:0546RHSA-2012:0570RHSA-2012:0569RHSA-2012:0568RHSA-2012:0547

  • php7 openSUSE Tumbleweed 7.0.14-1.4
  • php5 openSUSE Tumbleweed 5.6.28-1.1
  • php8 openSUSE Tumbleweed 8.0.11-1.1

opensuse advisories openSUSE-SU-2024:10290-1openSUSE-SU-2024:10344-1openSUSE-SU-2024:11169-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-1823 updated cvss 6.8

php: command line arguments injection when run in CGI mode (VU#520827)

  • Red Hat Enterprise Linux (v. 5 server) php 5.1.6-34.el5_8, php53 5.3.3-7.el5_8, php-gd 5.1.6-34.el5_8, php-cli 5.1.6-34.el5_8, php-dba 5.1.6-34.el5_8, php-pdo 5.1.6-34.el5_8, +32 more Red Hat Enterprise Linux Desktop Optional (v. 6) php 5.3.3-3.el6_2.8, php-gd 5.3.3-3.el6_2.8, php-cli 5.3.3-3.el6_2.8, php-dba 5.3.3-3.el6_2.8, php-pdo 5.3.3-3.el6_2.8, php-xml 5.3.3-3.el6_2.8, +19 more
    fixed: vendor fix RHSA-2012:0546
  • Red Hat Enterprise Linux EUS (v. 5.6 server) php 5.1.6-27.el5_6.4, php53 5.3.3-1.el5_6.2, php-gd 5.1.6-27.el5_6.4, php-cli 5.1.6-27.el5_6.4, php-dba 5.1.6-27.el5_6.4, php-pdo 5.1.6-27.el5_6.4, +32 more
    fixed: vendor fix RHSA-2012:0568
  • Red Hat Enterprise Linux HPC Node (v. 6) php 5.3.3-3.el6_2.8, php-cli 5.3.3-3.el6_2.8, php-common 5.3.3-3.el6_2.8 Red Hat Enterprise Linux HPC Node Optional (v. 6) php 5.3.3-3.el6_2.8, php-gd 5.3.3-3.el6_2.8, php-dba 5.3.3-3.el6_2.8, php-pdo 5.3.3-3.el6_2.8, php-xml 5.3.3-3.el6_2.8, php-zts 5.3.3-3.el6_2.8, +17 more
    fixed: vendor fix RHSA-2012:0546
  • Red Hat Enterprise Linux Long Life (v. 5.3 server) php 5.1.6-23.3.el5_3, php-gd 5.1.6-23.3.el5_3, php-cli 5.1.6-23.3.el5_3, php-dba 5.1.6-23.3.el5_3, php-pdo 5.1.6-23.3.el5_3, php-xml 5.1.6-23.3.el5_3, +12 more
    fixed: vendor fix RHSA-2012:0568
  • Red Hat Enterprise Linux Server (v. 6) php 5.3.3-3.el6_2.8, php-gd 5.3.3-3.el6_2.8, php-cli 5.3.3-3.el6_2.8, php-pdo 5.3.3-3.el6_2.8, php-xml 5.3.3-3.el6_2.8, php-ldap 5.3.3-3.el6_2.8, +6 more
    fixed: vendor fix RHSA-2012:0546
  • Red Hat Enterprise Linux Server EUS (v. 6.0) php 5.3.2-6.el6_0.2, php-gd 5.3.2-6.el6_0.2, php-cli 5.3.2-6.el6_0.2, php-pdo 5.3.2-6.el6_0.2, php-xml 5.3.2-6.el6_0.2, php-ldap 5.3.2-6.el6_0.2, +6 more Red Hat Enterprise Linux Server EUS (v. 6.1) php 5.3.3-3.el6_1.4, php-gd 5.3.3-3.el6_1.4, php-cli 5.3.3-3.el6_1.4, php-pdo 5.3.3-3.el6_1.4, php-xml 5.3.3-3.el6_1.4, php-ldap 5.3.3-3.el6_1.4, +6 more
    fixed: vendor fix RHSA-2012:0568
  • Red Hat Enterprise Linux Server Optional (v. 6) php 5.3.3-3.el6_2.8, php-dba 5.3.3-3.el6_2.8, php-zts 5.3.3-3.el6_2.8, php-imap 5.3.3-3.el6_2.8, php-intl 5.3.3-3.el6_2.8, php-snmp 5.3.3-3.el6_2.8, +8 more
    fixed: vendor fix RHSA-2012:0546
  • Red Hat Enterprise Linux Server Optional EUS (v. 6.0) php 5.3.2-6.el6_0.2, php-dba 5.3.2-6.el6_0.2, php-zts 5.3.2-6.el6_0.2, php-imap 5.3.2-6.el6_0.2, php-intl 5.3.2-6.el6_0.2, php-snmp 5.3.2-6.el6_0.2, +8 more Red Hat Enterprise Linux Server Optional EUS (v. 6.1) php 5.3.3-3.el6_1.4, php-dba 5.3.3-3.el6_1.4, php-zts 5.3.3-3.el6_1.4, php-imap 5.3.3-3.el6_1.4, php-intl 5.3.3-3.el6_1.4, php-snmp 5.3.3-3.el6_1.4, +8 more
    fixed: vendor fix RHSA-2012:0568
show 2 more
  • Red Hat Enterprise Linux Workstation (v. 6) php 5.3.3-3.el6_2.8, php-gd 5.3.3-3.el6_2.8, php-cli 5.3.3-3.el6_2.8, php-pdo 5.3.3-3.el6_2.8, php-xml 5.3.3-3.el6_2.8, php-ldap 5.3.3-3.el6_2.8, +6 more Red Hat Enterprise Linux Workstation Optional (v. 6) php 5.3.3-3.el6_2.8, php-dba 5.3.3-3.el6_2.8, php-zts 5.3.3-3.el6_2.8, php-imap 5.3.3-3.el6_2.8, php-intl 5.3.3-3.el6_2.8, php-snmp 5.3.3-3.el6_2.8, +8 more Red Hat RHEL Desktop Workstation (v. 5 client) php 5.1.6-34.el5_8, php53 5.3.3-7.el5_8, php-gd 5.1.6-34.el5_8, php-cli 5.1.6-34.el5_8, php-dba 5.1.6-34.el5_8, php-pdo 5.1.6-34.el5_8, +32 more
    fixed: vendor fix RHSA-2012:0546
  • Red Hat Enterprise Linux 4 php
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/php_cgi_arg_injection)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-04-15 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
PHP, PHP
CISA name
PHP-CGI Query String Parameter Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/php_cgi_arg_injection PHP CGI Argument Injection metasploit exploit, excellent rank, 2012-05-03
  • EDB-29316 Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner remote, 2013-10-31
  • EDB-29290 Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution remote, 2013-10-29
  • EDB-18836 PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection remote, 2012-05-05
  • EDB-18834 PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit) remote, 2012-05-04
  • Nuclei template PHP CGI v5.3.12/5.4.2 Remote Code Execution nuclei detection template
  • php.net http://www.php.net/ChangeLog-5.php#5.4.2 referenced PoC, tagged "exploit" by a source, unverified
  • bugs.php.net https://bugs.php.net/bug.php?id=61910 referenced PoC, tagged "exploit" by a source, unverified
  • eindbazen.net http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ referenced PoC, tagged "exploit" by a source, unverified
  • kb.cert.org http://www.kb.cert.org/vuls/id/520827 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.