Fluid Attacks Database

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	php	<0:5.1.6-34.el5_8	0:5.1.6-34.el5_8
rpm rhel6	php	<0:5.3.3-3.el6_2.8	0:5.3.3-3.el6_2.8
rpm rhel5	php53	<0:5.3.3-7.el5_8	0:5.3.3-7.el5_8

Aliases

1. CVE-2012-18232. NVD-2012-18233. OSV-2012-1823

References

1. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-18232. https://www.exploit-db.com/exploits/292903. https://www.exploit-db.com/exploits/188344. https://www.exploit-db.com/exploits/188365. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1823.yaml6. https://github.com/drone789/CVE-2012-18237. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/php_cgi_arg_injection.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.