CVE-2012-1823
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published May 11, 2012
Updated: Jan 6, 2025
CWE ID 77
Summary
CVE-2012-1823 is a vulnerability affecting PHP versions before 5.3.12 and 5.4.x, when used as a CGI script (php-cgi). The issue lies in the sapi/cgi/cgi_main.c file, where the software fails to appropriately manage query strings lacking an equals sign (=) character. Malicious actors can exploit this flaw by inserting command-line options within the query string, ultimately leading to the execution of arbitrary code. This vulnerability emerged due to the lack of proper skipping of a specific php_getopt function for the 'd' case.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- PHP: Hypertext Preprocessor
Affected Vendors
- Php