CVE-2012-1823 PHP-CGI Query String Parameter
Remote attackers can execute arbitrary code on PHP servers configured as CGI by injecting command-line options via query strings.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-1823?
CVE-2012-1823 is a critical command injection vulnerability in Apple Mac Os X, published on 11 May 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Weakness: CWE-77
Which versions are affected by CVE-2012-1823?
It affects 17 products.
Linux distribution packages (40)
php Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-bcmath Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-cli Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-common Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-dba Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-gd Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-imap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-ldap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-mbstring Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-mysql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-ncurses Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-odbc Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-pdo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-pgsql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-snmp Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-soap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-xml Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php-xmlrpc Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.1.6-34.el5_8 |
php53 Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-bcmath Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-cli Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-common Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-dba Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-gd Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-imap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-intl Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-ldap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-mbstring Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-mysql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-odbc Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-pdo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-pgsql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-process Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-pspell Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-snmp Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
php53-soap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:5.3.3-7.el5_8 |
Products include Apple Mac Os X, Debian Debian Linux, Fedoraproject Fedora, Hp Hp-Ux, Opensuse Opensuse, Php Php and 11 more.
How do I fix CVE-2012-1823?
Upgrade to a fixed version. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2012-1823 being exploited?
Yes. Attackers have exploited CVE-2012-1823 in the wild since at least 25 Mar 2022.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 16 proofs of concept on GitHub.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as GHSA-3p37-hv77-x3rp, RHSA-2012:0546, RHSA-2012:0547, RHSA-2012:0568, RHSA-2012:0569, RHSA-2012:0570.