sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is in the KEV database since March 25, 2022.

The EPSS score is 0.94386.

Exploitation active

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Apple
  • Mac Os X
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Hp
  • Hp-ux
Opensuse
  • Opensuse
Php
  • Php
Redhat
  • Application Stack
  • Enterprise Linux
  • Enterprise Linux Desktop
  • Enterprise Linux Eus
  • Enterprise Linux Server
  • Enterprise Linux Server Aus
  • Enterprise Linux Workstation
  • Gluster Storage Server For On-premise
  • Rhel Eus
  • Rhel Mission Critical
  • Storage
  • Storage For Public Cloud
Suse
  • Linux Enterprise Server
  • Linux Enterprise Software Development Kit

Configuration 1 [-]

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*

Configuration 5 [-]

OR cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Configuration 7 [-]

OR cpe:2.3:a:redhat:application_stack:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5
php-0:5.1.6-34.el5_8 cpe:/o:redhat:enterprise_linux:5 RHSA-2012:0546 2012-05-07T00:00:00Z
php53-0:5.3.3-7.el5_8 cpe:/o:redhat:enterprise_linux:5 RHSA-2012:0547 2012-05-07T00:00:00Z
Red Hat Enterprise Linux 5.3 Long Life
php-0:5.1.6-23.3.el5_3 cpe:/o:redhat:rhel_mission_critical:5.3 RHSA-2012:0568 2012-05-10T00:00:00Z
Red Hat Enterprise Linux 5.6 EUS - Server Only
php-0:5.1.6-27.el5_6.4 cpe:/o:redhat:rhel_eus:5.6 RHSA-2012:0568 2012-05-10T00:00:00Z
php53-0:5.3.3-1.el5_6.2 cpe:/o:redhat:rhel_eus:5.6 RHSA-2012:0569 2012-05-10T00:00:00Z
Red Hat Enterprise Linux 6
php-0:5.3.3-3.el6_2.8 cpe:/o:redhat:enterprise_linux:6 RHSA-2012:0546 2012-05-07T00:00:00Z
Red Hat Enterprise Linux 6.0 EUS - Server Only
php-0:5.3.2-6.el6_0.2 cpe:/o:redhat:rhel_eus:6.0 RHSA-2012:0568 2012-05-10T00:00:00Z
Red Hat Enterprise Linux 6.1 EUS - Server Only
php-0:5.3.3-3.el6_1.4 cpe:/o:redhat:rhel_eus:6.1 RHSA-2012:0568 2012-05-10T00:00:00Z

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-2465-1 php5 security update
Ubuntu USN Ubuntu USN USN-1437-1 PHP vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ cve-icon cve-icon
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 cve-icon cve-icon
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=134012830914727&w=2 cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0546.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0547.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0568.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0569.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0570.html cve-icon cve-icon
http://secunia.com/advisories/49014 cve-icon cve-icon
http://secunia.com/advisories/49065 cve-icon cve-icon
http://secunia.com/advisories/49085 cve-icon cve-icon
http://secunia.com/advisories/49087 cve-icon cve-icon
http://support.apple.com/kb/HT5501 cve-icon cve-icon
http://www.debian.org/security/2012/dsa-2465 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/520827 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/673343 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2024/06/07/1 cve-icon cve-icon
http://www.php.net/ChangeLog-5.php#5.4.2 cve-icon cve-icon
http://www.php.net/archive/2012.php#id2012-05-03-1 cve-icon cve-icon
http://www.securitytracker.com/id?1027022 cve-icon cve-icon
https://bugs.php.net/bug.php?id=61910 cve-icon cve-icon
https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2012-1823 cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2012-1823 cve-icon
History

Wed, 22 Oct 2025 01:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 19:30:00 +0000

Type Values Removed Values Added
References

Fri, 07 Feb 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2022-03-25'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jan 2025 19:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo CWE-77

Tue, 13 Aug 2024 23:30:00 +0000

Type Values Removed Values Added
References
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2025-10-22T00:05:47.580Z

Reserved: 2012-03-21T00:00:00.000Z

Link: CVE-2012-1823

cve-icon Vulnrichment

Updated: 2024-08-06T19:08:38.505Z

cve-icon NVD

Status : Deferred

Published: 2012-05-11T10:15:48.043

Modified: 2025-10-22T01:15:43.930

Link: CVE-2012-1823

cve-icon Redhat

Severity : Critical

Publid Date: 2012-05-03T00:00:00Z

Links: CVE-2012-1823 - Bugzilla

cve-icon OpenCVE Enrichment

No data.