OS command injection in PHP - CVE-2012-2311

Vulnerability identifier: #VU5939

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-2311

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to error when parsing QUERY_STRING parameters within PHP-CGI-based application (sapi/cgi/cgi_main.c). A remote attacker can send specially crafted HTTP request with query string, contain a %3D sequence but no = (equals sign) character, inject and execute arbitrary OS commands on vulnerable system with privileges of the web server.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

This vulnerability is a result of an incomplete fix for SB2012050301.

Note: the vulnerability was being actively exploited.

PHP

Gentoo Linux
SUSE Linux
php5 (Ubuntu package)
HP-UX Web Server Suite

Update to version 5.3.13 or 5.4.3 or later.

php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.15, 5.3.10-1ubuntu3.1
HP-UX Web Server Suite - addressed in versions 2.36, 3.24

• Exploit #1061 - Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution (Multithreaded Scanner) (March 18, 2020)
• Exploit #1062 - Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution (March 18, 2020)
• Exploit #1063 - PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection (March 18, 2020)
• Exploit #1064 - PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit) (March 18, 2020)

• https://bugs.php.net/bug.php?id=61807

• Remote command injection in PHP
• Ubuntu update for PHP
• openSUSE update for flash-player
• SUSE Linux update for PHP5
• SUSE Linux update for PHP5
• SUSE Linux update for PHP5
• Gentoo update for PHP
• Multiple vulnerabilities in HP-UX Apache Web Server running PHP