Vulnerability CVE-2012-1823

Vulnerability CVE-2012-1823

Published: 2012-05-11

Description:

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

See advisories in our WLB2 database:

	Topic	Author	Date
High	PHP up to 5.3.12 and 5.4.2 CGI Injection (metasploit exploit)	wofeiwo	06.05.2012
High	PHP up to 5.3.12 and 5.4.2 CGI Injection (python exploit)	wofeiwo	06.05.2012
High	PHP 5.3.12 CGI Argument Injection (PHP Exploit)	Mostafa Azizi	23.05.2012
High	PHP-CGI Argument Injection Remote Code Execution	infodox	25.12.2012

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
PHP -> PHP

References:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html

http://marc.info/?l=bugtraq&m=134012830914727&w=2

http://rhn.redhat.com/errata/RHSA-2012-0546.html

http://rhn.redhat.com/errata/RHSA-2012-0547.html

http://rhn.redhat.com/errata/RHSA-2012-0568.html

http://rhn.redhat.com/errata/RHSA-2012-0569.html

http://rhn.redhat.com/errata/RHSA-2012-0570.html

http://support.apple.com/kb/HT5501

http://www.debian.org/security/2012/dsa-2465

http://www.kb.cert.org/vuls/id/520827

http://www.kb.cert.org/vuls/id/673343

http://www.mandriva.com/security/advisories?name=MDVSA-2012:068

http://www.php.net/archive/2012.php#id2012-05-03-1

http://www.php.net/ChangeLog-5.php#5.4.2

http://www.securitytracker.com/id?1027022

https://bugs.php.net/bug.php?id=61910

https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1

Vulnerability CVE-2012-1823

See advisories in our WLB2 database:

High

PHP up to 5.3.12 and 5.4.2 CGI Injection (metasploit exploit)

High

PHP up to 5.3.12 and 5.4.2 CGI Injection (python exploit)

High

PHP 5.3.12 CGI Argument Injection (PHP Exploit)

High

PHP-CGI Argument Injection Remote Code Execution

CWE-20

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

7.5/10

6.4/10

10/10

Remote

Low

No required

Partial

Partial

Partial

Affected software

References: