---
id: "CVE-2012-1823"
kind: "vulnerability"
aliases: ["CVE-2012-1823"]
title: "PHP PHP: PHP-CGI Query String Parameter Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99998
exploited: true
status: "resolved"
category: "runtime"
products: [{"name": "PHP PHP", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "PHP", "fixed": ["5.3.13", "5.4.3"], "affected": "< 5.3.12, >= 5.4.0, < 5.4.2 (php-cgi only)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache", "exploited", "php", "php-cgi", "rce", "runtime", "self-hosted"]
not_affected_if: ["fastcgi-only", "managed-hosting", "mod_php", "mod_php-or-php-fpm", "php-cli-only", "php-fpm"]
published_at: "2012-05-11T10:15:48+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-1823", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-1823", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:22:40+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1823", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# PHP PHP: PHP-CGI Query String Parameter Vulnerability

PHP built/run as CGI (php-cgi, e.g. Apache mod_cgi/cgid or ScriptAlias setups) passes query strings with no '=' (such as ?-s or ?-d...) to the binary as command-line options. An unauthenticated remote attacker can read PHP source or run code as the web server user (auto_prepend_file via php://input). Affects PHP before 5.3.12 and 5.4.0-5.4.1 (NVD). Actively exploited; KEV-listed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PHP PHP affected ? fixed ?
- vendor:PHP affected < 5.3.12, >= 5.4.0, < 5.4.2 (php-cgi only) fixed 5.3.13, 5.4.3

## How to check

Run 'php -v' and 'php-cgi -v'; anything below 5.3.13 / 5.4.3 is at risk if served through CGI. Check whether php-cgi is wired to the web server: grep for 'php-cgi', 'AddHandler cgi-script', 'ScriptAlias' or 'Action application/x-httpd-php' in Apache/nginx config. Quick test on a non-production host: request /index.php?-s ; if you get highlighted PHP source back, you are vulnerable. PHP-FPM, mod_php and FastCGI-only setups are not affected by this path.

## Fix

Upgrade to PHP 5.3.13 / 5.4.3 or later (CERT/CC; 5.3.12 / 5.4.2 was the first fix), preferably a currently supported PHP 8.x since 5.x is long end-of-life. Distro packages: RHSA-2012:0546 etc. Workaround: switch to PHP-FPM or mod_php; or Apache rule: RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] then RewriteRule ^(.*) $1? [L].

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-1823
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2012-1823
- 2026-10-23T21:22:40+00:00 analyst — Read CERT/CC VU#520827, PHP bug 61910, PHP 5.4.2/5.3.12 changelog commit, RHSA-2012:0546, NVD. Initial fix 5.3.12/5.4.2 (3 May 2012); CERT/CC says 5.3.13/5.4.3 are the releases to use (initial fix reported incomplete; I did not read the follow-up CVE page). PoC trivial and public in the bug report (?-s). Exploited: CISA KEV, SSVC active.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2012-1823

## Documents

- [advisory] VU#520827 PHP-CGI query string parameter vulnerability https://www.kb.cert.org/vuls/id/520827
- [describes] NVD CVE-2012-1823 https://nvd.nist.gov/vuln/detail/CVE-2012-1823
- [fix] PHP 5.4.2 and 5.3.12 release / ChangeLog https://news-web.php.net/php.webmaster/13444
- [fix] RHSA-2012:0546 php security update https://access.redhat.com/errata/RHSA-2012:0546.html
- [poc] PHP Sec Bug #61910 https://bugs.php.net/61910

## From the sources

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_