OS command injection in PHP - CVE-2012-1823
Published: January 11, 2017 / Updated: June 7, 2024
Vulnerability identifier: #VU4201
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-1823
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to error when parsing QUERY_STRING parameters within PHP-CGI-based application (sapi/cgi/cgi_main.c). A remote attacker can send specially crafted HTTP request with query string without the "=" (equals sign) character, inject and execute arbitrary OS commands on vulnerable system with privileges of the web server.
Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The weakness exists due to error when parsing QUERY_STRING parameters within PHP-CGI-based application (sapi/cgi/cgi_main.c). A remote attacker can send specially crafted HTTP request with query string without the "=" (equals sign) character, inject and execute arbitrary OS commands on vulnerable system with privileges of the web server.
Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Affected software
PHP
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
SUSE Linux
Slackware Linux
EasyApache
php (Alpine package)
php5 (Ubuntu package)
php81
HP-UX Web Server Suite
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
SUSE Linux
Slackware Linux
EasyApache
php (Alpine package)
php5 (Ubuntu package)
php81
HP-UX Web Server Suite
How to mitigate CVE-2012-1823
Update to version 5.3.12 or 5.4.2 or later.
PHP - update to 8.3.8
EasyApache - update to 4 2024-6-10
php (Alpine package) - update to 5.3.12-r0
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.15, 5.3.10-1ubuntu3.1
HP-UX Web Server Suite - addressed in versions 2.36, 3.24
php81 - update to 8.1.29
EasyApache - update to 4 2024-6-10
php (Alpine package) - update to 5.3.12-r0
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.15, 5.3.10-1ubuntu3.1
HP-UX Web Server Suite - addressed in versions 2.36, 3.24
php81 - update to 8.1.29
Links to Public Exploits and PoC-codes
- Exploit #751 - Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution (Multithreaded Scanner) (March 18, 2020)
- Exploit #752 - Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution (March 18, 2020)
- Exploit #753 - PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection (March 18, 2020)
- Exploit #754 - PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit) (March 18, 2020)
- Exploit #1767 - PHP CGI Argument Injection (March 18, 2020)
External References
Related Security Bulletins
- Remote command injection in PHP
- Ubuntu update for PHP
- Amazon Linux AMI update for php
- openSUSE update for flash-player
- Red Hat update for php53
- Red Hat update for php
- OS command injection in php (Alpine package)
- SUSE Linux update for PHP5
- SUSE Linux update for PHP5
- SUSE Linux update for PHP5
- Gentoo update for PHP
- Multiple vulnerabilities in HP-UX Apache Web Server running PHP
- Slackware Linux update for php
- cPanel EasyApache update for PHP