{"id":"CVE-2012-2311","published":"2012-05-11T10:00:00Z","modified":"2024-08-06T19:26:09Z","title":"sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.69266,"percentile":0.99354,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2012-05-09","exploitedFirstSeen":"2012-05-09","ransomware":false,"evidence":[{"url":"https://blog.sucuri.net/2012/05/php-cgi-vulnerability-exploited-in-the-wild.html","date":"2012-05-09"},{"url":"https://www.fortiguard.com/encyclopedia/ips/31752","date":"2012-06-19"},{"url":"https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/","date":"2018-01-15"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://marc.info/?l=bugtraq&m=134012830914727&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securitytracker.com/id?1027022","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff-fix-check.patch&revision=1336093719&display=1","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/49014","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://bugs.php.net/bug.php?id=61910","tags":["x_refsource_CONFIRM"]},{"url":"http://www.php.net/archive/2012.php#id2012-05-08-1","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://support.apple.com/kb/HT5501","tags":["x_refsource_CONFIRM"]},{"url":"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/","tags":["x_refsource_MISC"]},{"url":"http://www.kb.cert.org/vuls/id/520827","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.debian.org/security/2012/dsa-2465","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://secunia.com/advisories/49085","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.php.net/ChangeLog-5.php#5.4.3","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-2304","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-2304","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":18834,"url":"https://www.exploit-db.com/exploits/18834","title":"PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)","type":"remote","platform":"php","date":"2012-05-04","verified":true,"provenance":"source"},{"id":18836,"url":"https://www.exploit-db.com/exploits/18836","title":"PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection","type":"remote","platform":"php","date":"2012-05-05","verified":true,"provenance":"source"},{"id":29290,"url":"https://www.exploit-db.com/exploits/29290","title":"Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution","type":"remote","platform":"php","date":"2013-10-29","verified":true,"provenance":"source"},{"id":29316,"url":"https://www.exploit-db.com/exploits/29316","title":"Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner","type":"remote","platform":"php","date":"2013-10-31","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2012-05-04"},"first":{"date":"2012-05-04","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/18834"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2012-05-04","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-18834)","url":"https://www.exploit-db.com/exploits/18834","provenance":"source"},{"date":"2012-05-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.sucuri.net/2012/05/php-cgi-vulnerability-exploited-in-the-wild.html","provenance":"source"},{"date":"2012-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2012-2311","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":60.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5286 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9935"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 Exploit-DB entries"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-php-cve-2012-1823","parents":[{"from":"CVE-2012-1823","to":"CVE-2012-2311","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.","from":"CVE.org","in":"CVE-2012-2311"}]}]}}