Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2012-1823

Опубликовано: 11 мая 2012
Источник: nvd
CVSS3: 9.8
CVSS2: 7.5
EPSS Критический

Описание

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Версия до 5.3.12 (исключая)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Версия от 5.4.0 (включая) до 5.4.2 (исключая)
Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Конфигурация 3
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
Конфигурация 4

Одно из

cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
Конфигурация 5

Одно из

cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
Конфигурация 6

Одно из

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Версия от 10.6.8 (включая) до 10.7.5 (исключая)
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Версия от 10.8.0 (включая) до 10.8.2 (исключая)
Конфигурация 7

Одно из

cpe:2.3:a:redhat:application_stack:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%
0.94386
Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-77
CWE-77

Связанные уязвимости

ubuntu логотип

CVE-2012-1823

CVSS3: 9.8
ubuntu
около 13 лет назад

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

redhat логотип

CVE-2012-1823

redhat
около 13 лет назад

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

debian логотип

CVE-2012-1823

CVSS3: 9.8
debian
около 13 лет назад

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when ...

github логотип

GHSA-3p37-hv77-x3rp

CVSS3: 9.8
github
около 3 лет назад

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

oracle-oval логотип

ELSA-2012-0547

oracle-oval
около 13 лет назад

ELSA-2012-0547: php53 security update (CRITICAL)

EPSS

Процентиль: 100%
0.94386
Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-77
CWE-77