CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
Description
CVE-2012-1823 is a critical command injection vulnerability affecting PHP PHP (versions < 5.3.12; >= 5.4.0, < 5.4.2). sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. CISA has added CVE-2012-1823 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.39% (100.0th percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| php | php | < 5.3.12; >= 5.4.0, < 5.4.2 |
| fedoraproject | fedora | 39; 40 |
| debian | debian linux | 6.0 |
| hp | hp-ux | b.11.23; b.11.31 |
| opensuse | opensuse | 11.4; 12.1 |
| suse | linux enterprise server | 10; 11 |
| suse | linux enterprise software development kit | 10; 11 |
| apple | mac os x | >= 10.6.8, < 10.7.5; >= 10.8.0, < 10.8.2 |
| redhat | application stack | 2.0 |
| redhat | gluster storage server for on-premise | 2.0 |
| redhat | storage | 2.0 |
| redhat | storage for public cloud | 2.0 |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux eus | 5.6; 6.1; 6.2 |
| redhat | enterprise linux server | 5.0; 6.0 |
| redhat | enterprise linux server aus | 5.3; 5.6 |
| redhat | enterprise linux workstation | 5.0; 6.0 |
References
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/(Broken Link, Exploit)
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041(Broken Link)
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=134012830914727&w=2(Mailing List)
- http://rhn.redhat.com/errata/RHSA-2012-0546.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-0547.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-0568.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-0569.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2012-0570.html(Third Party Advisory)
- http://secunia.com/advisories/49014(Broken Link)
- http://secunia.com/advisories/49065(Broken Link)
- http://secunia.com/advisories/49085(Broken Link)
- http://secunia.com/advisories/49087(Broken Link)
- http://support.apple.com/kb/HT5501(Third Party Advisory)
- http://www.debian.org/security/2012/dsa-2465(Third Party Advisory)
- http://www.kb.cert.org/vuls/id/520827(Exploit, Third Party Advisory, US Government Resource)
- http://www.kb.cert.org/vuls/id/673343(Third Party Advisory, US Government Resource)
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:068(Broken Link)
- http://www.openwall.com/lists/oss-security/2024/06/07/1(Mailing List)
- http://www.php.net/ChangeLog-5.php#5.4.2(Exploit, Patch, Release Notes)
- http://www.php.net/archive/2012.php#id2012-05-03-1(Release Notes)
- http://www.securitytracker.com/id?1027022(Broken Link, Third Party Advisory, VDB Entry)
- https://bugs.php.net/bug.php?id=61910(Exploit, Patch)
- https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1(Patch)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/(Mailing List, Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command Injection is a critical vulnerability that occurs when software constructs all or part of a command using externally-influenced input from an upstream component, but fails to neutralize or incorrectly neutralizes special elements that could modify the intended command when executed. This allows attackers to inject malicious commands that are executed by the underlying system with the same privileges as the vulnerable application. In the case of CVE-2012-1823, this weakness manifests in PHP PHP where sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2012-1823 poses a critical threat to organizations running PHP PHP, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2012-1823 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 94.39% (100.0th percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Public exploit code is available, lowering the barrier for attackers and increasing the urgency to patch. Despite being over 14 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade PHP PHP from affected versions (< 5.3.12; >= 5.4.0, < 5.4.2) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected PHP service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to PHP.
- Evaluate whether affected PHP PHP deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2012-1823 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting PHP PHP in versions < 5.3.12; >= 5.4.0, < 5.4.2. sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2012-1823 being actively exploited?
Yes. CVE-2012-1823 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.39% (100.0th percentile) indicates a very high probability of exploitation. Public exploit code is available, further increasing the risk.
What products are affected by CVE-2012-1823?
CVE-2012-1823 primarily affects PHP PHP, as well as Fedoraproject Fedora, Debian Debian Linux, Hp Hp-ux. The affected versions include < 5.3.12; >= 5.4.0, < 5.4.2. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2012-1823?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (< 5.3.12; >= 5.4.0, < 5.4.2) to the latest patched release from PHP. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2012-1823?
CVE-2012-1823 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.