ZeroDay Findings
Sign inSign up

Findings

CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

Published May 11, 2012 · updated Jun 16, 2026 · php php

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Timeline

Detection, updates, and resolution for this record.

  1. May 11, 2012 · Catalog

    Detected

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe apple/mac os xversion unspecified
  • cpe debian/debian linux6.0
  • cpe fedoraproject/fedora39
  • cpe fedoraproject/fedora40
  • cpe hp/hp-uxb.11.23
  • cpe hp/hp-uxb.11.31
  • cpe opensuse/opensuse11.4
  • cpe php/phpversion unspecified
  • cpe redhat/application stack2.0
  • vendor PHP PHPversion unspecified

Sources

  • CISA KEVCVE-2012-1823

    sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

    cisa.gov
  • CVE.orgCVE-2012-1823

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2012-1823

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database18834

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database29290

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database29316

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/php_cgi_arg_injection

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2012-1823

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options i

    nvd.nist.gov

References