Skip to content
Back to search

CVE-2012-1823

CRITICAL
9.8 CISA KEVNVD

Summary

generated automatically from NVD data

PHP's CGI mode (php-cgi), implemented in sapi/cgi/cgi_main.c, mishandles query strings that contain no equals sign. A remote attacker can place command-line options in the query string, because a certain php_getopt step for the 'd' case is not skipped, and this lets them execute arbitrary code. The flaw affects PHP before 5.3.12 and 5.4.x before 5.4.2, is listed in CISA's KEV catalog as exploited, and carries a CVSS v3.1 score of 9.8 (CRITICAL).

NVD description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2022-04-15

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
11 mai 2012
Updated
16 juin 2026
Status
Analyzed
Source
cret@cert.org

Affected products

php phpAll PHP CVEs →
Versions : 5.3.12, 5.4.2
fedoraproject fedora
Versions : 39, 40
debian debian linux
Versions : 6.0
hp hp-ux
Versions : b.11.23, b.11.31
opensuse opensuse
Versions : 11.4, 12.1
suse linux enterprise server
Versions : 10, 11
suse linux enterprise software development kit
Versions : 10, 11
apple mac os x
Versions : 10.7.5, 10.8.2

Weaknesses (CWE)

CWE-77CWE-77

References (60)

Similar CVEs

Other vulnerabilities of type CWE-77

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring