Live › vulnerability › CVE-2012-1823
Go to dashboardPHP built/run as CGI (php-cgi, e.g. Apache mod_cgi/cgid or ScriptAlias setups) passes query strings with no '=' (such as ?-s or ?-d...) to the binary as command-line options. An unauthenticated remote attacker can read PHP source or run code as the web server user (auto_prepend_file via php://input). Affects PHP before 5.3.12 and 5.4.0-5.4.1 (NVD). Actively exploited; KEV-listed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PHP PHP | vendor | – | – |
| PHP | vendor | < 5.3.12, >= 5.4.0, < 5.4.2 (php-cgi only) | 5.3.13, 5.4.3 |
php -v and php-cgi -v; anything below 5.3.13 / 5.4.3 is at risk if served through CGIphp-cgi, AddHandler cgi-script, ScriptAlias or Action application/x-httpd-php in Apache/nginx config5.3.13 / 5.4.3 or later (CERT/CC; 5.3.12 / 5.4.2 was the first fix), preferably a currently supported PHP 8.x since 5.x is long end-of-lifeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
This page as .md · .json · in your agent: get_signal("CVE-2012-1823")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.