Description
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-14.el6_3 | RHSA-2012:1046 |
| RHEL 5 | php +18 | 5.1.6-39.el5_8 | RHSA-2012:1045 |
| RHEL 5 | php53 +20 | 5.3.3-13.el5_8 | RHSA-2012:1047 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 4
- Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner EDB-29316 · remote · Oct 31, 2013
- Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution EDB-29290 · remote · Oct 29, 2013 · verified
- PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection EDB-18836 · remote · May 5, 2012 · verified
- PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit) EDB-18834 · remote · May 4, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2012:1046 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1047 Red Hat Security Advisory: php53 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1045 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SU-2012:0721 vendor-advisory
- SUSE-SU-2012:0840 vendor-advisory
- https://bugs.php.net/patch-display.php?bug_id=61910&patch=CVE-2012-1823.patch&revision=1336251592&display=1
- 49014 third-party-advisory
- https://bugs.php.net/bug.php?id=61910
- http://www.php.net/archive/2012.php#id2012-05-08-1
- SSRT100992 vendor-advisory
- http://www.php.net/ChangeLog-5.php#5.4.3