Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze9 | DSA-2465-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_2.8 | RHSA-2012:0546 |
| RHEL 5 | php +18 | 5.1.6-34.el5_8 | RHSA-2012:0546 |
| RHEL 5 | php53 +20 | 5.3.3-7.el5_8 | RHSA-2012:0547 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 5 | php +18 | 5.1.6-23.3.el5_3 | RHSA-2012:0568 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.10-2.el5s2 | RHSA-2012:0570 |
| RHEL 6.1 EUS | php +25 | 5.3.3-3.el6_1.4 | RHSA-2012:0568 |
| RHEL 6.0 EUS | php +25 | 5.3.2-6.el6_0.2 | RHSA-2012:0568 |
| RHEL 5.6 EUS | php +18 | 5.1.6-27.el5_6.4 | RHSA-2012:0568 |
| RHEL 5.6 EUS | php53 +20 | 5.3.3-1.el5_6.2 | RHSA-2012:0569 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
PHP CGI Argument Injection
exploit/multi/http/php_cgi_arg_injection
Exploit-DB 4
- Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner EDB-29316 · remote · Oct 31, 2013
- Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution EDB-29290 · remote · Oct 29, 2013 · verified
- PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection EDB-18836 · remote · May 5, 2012 · verified
- PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit) EDB-18834 · remote · May 4, 2012 · verified
GitHub 16 repositories · most starred shown
-
0xl0k1/CVE-2012-1823 ★ 12 · Aug 24, 2023
PHP CGI Argument Injection.
-
Unix13/metasploitable2 ★ 5 · Jul 5, 2019
PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon, misconfigured NFS files, etc.
-
mujtaba815/metasploitable2-php-cgi-exploit ★ 3 · Oct 2, 2026
Exploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation
-
tardummy01/oscp_scripts-1 ★ 3 · Oct 1, 2017
First script, pgp-cgi-cve-2012-1823 BASH script
-
hackherMind-Pixel/Vulnerable-Lab-Exploitation ★ 1 · Jan 22, 2026
A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.
-
Dmitri131313/CVE-2012-1823-exploit-for-https-user-password-web ★ 1 · Mar 20, 2025
CVE-2012-1823 exploit for https user password website.
-
cyberharsh/PHP_CVE-2012-1823 ★ 1 · Aug 17, 2020
-
drone789/CVE-2012-1823 ★ 1 · Sep 8, 2015
-
nulltrace1336/PHP-CGI-Argument-Injection-Exploit ★ 0 · Dec 24, 2025
Ushbu videoda Kali Linux orqali Metasploitable 2 serveriga PHP CGI Argument Injection (CVE-2012-1823) ekspluatatsiyasi Metasploit yordamida amalga oshiriladi
-
Jimmy01240397/CVE-2012-1823-Analyze ★ 0 · Dec 9, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- PHP CGI v5.3.12/5.4.2 Remote Code Execution http/cves/2012/CVE-2012-1823.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 9
- RHSA-2012:0546 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0568 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0547 Red Hat Security Advisory: php53 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2465-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2012:0569 Red Hat Security Advisory: php53 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2012:0570 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- SSRT100856 vendor-advisory
- SUSE-SU-2012:0604 vendor-advisory
- 1027022 vdb-entry
- HPSBMU02786 vendor-advisory
- MDVSA-2012:068 vendor-advisory
- openSUSE-SU-2012:0590 vendor-advisory
- RHSA-2012:0546 vendor-advisory
- RHSA-2012:0568 vendor-advisory
- RHSA-2012:0569 vendor-advisory
- http://www.php.net/ChangeLog-5.php#5.4.2
- 49014 third-party-advisory
- RHSA-2012:0570 vendor-advisory
- SUSE-SU-2012:0598 vendor-advisory
- https://bugs.php.net/bug.php?id=61910
- VU#673343 third-party-advisory
- RHSA-2012:0547 vendor-advisory
- APPLE-SA-2012-09-19-2 vendor-advisory
- http://support.apple.com/kb/HT5501
- http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
- 49065 third-party-advisory
- VU#520827 third-party-advisory
- https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1
- DSA-2465 vendor-advisory
- 49085 third-party-advisory
- http://www.php.net/archive/2012.php#id2012-05-03-1
- 49087 third-party-advisory
- [oss-security] 20240606 PHP security releases 8.3.8, 8.2.20, and 8.1.29 mailing-list
- FEDORA-2024-49aba7b305 vendor-advisory
- FEDORA-2024-52c23ef1ec vendor-advisory