Attacker Value
Unknown
CVE-2012-1823
CVE-2012-1823
(Last updated July 17, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Impact
Techniques
Validation
Metasploit Module
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the ’d’ case.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apple,
- debian,
- fedoraproject,
- hp,
- opensuse,
- php,
- redhat,
- suse
Products
- application stack 2.0,
- debian linux 6.0,
- enterprise linux desktop 6.0,
- enterprise linux eus 5.6,
- enterprise linux eus 6.1,
- enterprise linux eus 6.2,
- enterprise linux server 5.0,
- enterprise linux server 6.0,
- enterprise linux server aus 5.3,
- enterprise linux server aus 5.6,
- enterprise linux workstation 5.0,
- enterprise linux workstation 6.0,
- fedora 39,
- fedora 40,
- gluster storage server for on-premise 2.0,
- hp-ux b.11.23,
- hp-ux b.11.31,
- linux enterprise server 10,
- linux enterprise server 11,
- linux enterprise software development kit 10,
- linux enterprise software development kit 11,
- mac os x,
- opensuse 11.4,
- opensuse 12.1,
- php,
- storage 2.0,
- storage for public cloud 2.0
Metasploit Modules
References
Advisory
Exploit
PoCs that have not been added by contributors directly have been sourced from:
nomi-sec/PoC-in-GitHub.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
CVE-2012-1823 (https://github.com/Fatalitysec/CVE-2012-1823) (Added by AKB Worker)
