ZeroDay Findings
Sign inSign up

Findings

CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

Published May 11, 2012 · updated Jun 16, 2026 · php php

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 11, 2012 · Catalog

    Detected

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe apple/mac os xversion unspecified
  • cpe debian/debian linux6.0
  • cpe fedoraproject/fedora39
  • cpe fedoraproject/fedora40
  • cpe hp/hp-uxb.11.23
  • cpe hp/hp-uxb.11.31
  • cpe opensuse/opensuse11.4
  • cpe php/phpversion unspecified
  • cpe redhat/application stack2.0
  • vendor PHP PHPversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2012-1823

    sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2012-1823

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2012-1823

    30-day exploitation probability 100.0%

    first.org
  • Exploit DatabasePublic exploit reference18834

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference29290

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference29316

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/http/php_cgi_arg_injection

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2012-1823

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options i

    nvd.nist.gov

References

CVE-2012-1823 · ZeroDay Findings