{"id":"CVE-2012-2336","published":"2012-05-11T10:00:00Z","modified":"2024-08-06T19:34:23Z","title":"sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.52085,"percentile":0.98953,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2018-01-15","exploitedFirstSeen":"2018-01-15","ransomware":false,"evidence":[{"url":"https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/","date":"2018-01-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://bugs.php.net/patch-display.php?bug_id=61910&patch=CVE-2012-1823.patch&revision=1336251592&display=1","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/49014","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugs.php.net/bug.php?id=61910","tags":["x_refsource_CONFIRM"]},{"url":"http://www.php.net/archive/2012.php#id2012-05-08-1","tags":["x_refsource_CONFIRM"]},{"url":"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.php.net/ChangeLog-5.php#5.4.3","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-2329","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-2329","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":18834,"url":"https://www.exploit-db.com/exploits/18834","title":"PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)","type":"remote","platform":"php","date":"2012-05-04","verified":true,"provenance":"source"},{"id":18836,"url":"https://www.exploit-db.com/exploits/18836","title":"PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection","type":"remote","platform":"php","date":"2012-05-05","verified":true,"provenance":"source"},{"id":29290,"url":"https://www.exploit-db.com/exploits/29290","title":"Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution","type":"remote","platform":"php","date":"2013-10-29","verified":true,"provenance":"source"},{"id":29316,"url":"https://www.exploit-db.com/exploits/29316","title":"Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner","type":"remote","platform":"php","date":"2013-10-31","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2012-05-04"},"first":{"date":"2012-05-04","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/18834"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2012-05-04","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-18834)","url":"https://www.exploit-db.com/exploits/18834","provenance":"source"},{"date":"2012-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2012-2336","provenance":"source"},{"date":"2018-01-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":59.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3209 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.79,"detail":"percentile 0.9895"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 Exploit-DB entries"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-php-cve-2012-1823","parents":[{"from":"CVE-2012-1823","to":"CVE-2012-2336","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.","from":"CVE.org","in":"CVE-2012-2336"}]}]}}