CVE-2012-1823

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 11, 2012
Last modified
Jun 16, 2026
Added to CISA KEV
Mar 25, 2022
NVD status
Analyzed

Related CVEs from 2012

CVE-2012-18247.2Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain CVE-2012-18254.3Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 througCVE-2012-18266.0dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.CVE-2012-18276.5The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perfCVE-2012-18286.5The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated usCVE-2012-18293.5Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrarCVE-2012-183010.0Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 5CVE-2012-183110.0Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 55CVE-2012-183210.0WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted pCVE-2012-18335.0VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers tCVE-2012-18344.3Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 fCVE-2012-18354.3Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers
CVE-2012-1823: Critical severity, CVSS 9.8 | Vulnix