CVE-2012-1823: PHP-CGI query string option injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 3.1 score of 9.8, confirmed KEV listing and near-maximum EPSS probability.

What it is

PHP versions before 5.3.12 and 5.4.x before 5.4.2, when run as a CGI script (php-cgi), mishandle query strings that lack an equals sign, allowing command-line options to be passed through the query string. This lets a remote attacker inject PHP options such as -d to alter configuration and execute arbitrary code. It matters because php-cgi deployments are directly reachable over HTTP with no authentication.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the web server process, leading to full host compromise, data theft or use as a pivot point.

Attack surface

Reached over the network via HTTP requests to a php-cgi endpoint; the CVSS vector shows no privileges and no user interaction required. Any exposed php-cgi configuration is directly attackable.

Exploitation

CVE-2012-1823 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.99998, with reference tags marking public exploit material. Exploitation is confirmed and widespread.

What to do

• Upgrade PHP to 5.3.12, 5.4.2 or later, or apply the vendor patch for your distribution.
• If php-cgi cannot be patched, disable the CGI SAPI and use PHP-FPM or mod_php instead.
• Restrict or block direct HTTP access to php-cgi binaries at the web server or reverse proxy.
• Apply the relevant Red Hat, Debian, SUSE, Apple or HP vendor advisories for bundled PHP packages.
• Monitor and alert on query strings containing option-like tokens such as -d or --define.

Detection

• Search web and proxy logs for requests to php-cgi paths with query strings containing -d, -s, -r or other PHP CLI options.
• Alert on HTTP requests whose query string lacks an equals sign but contains leading dashes.
• Monitor web server child processes for unexpected command execution or outbound connections from the PHP process.
• Review exposed php-cgi endpoints and confirm they are not internet-facing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.