CVE-2012-1823

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.12 PHP versions 5.4.x prior to 5.4.2

Description The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code by placing command-line options in the query string, specifically when the query string lacks an equals sign character. The vulnerability is related to the lack of skipping a certain php getopt for the 'd' case.

Recommendations For PHP versions prior to 5.3.12, update to version 5.3.12 or later. For PHP versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later. As a temporary workaround, consider restricting access to the CGI script to minimize the risk of exploitation.