Vulnerability record · CVE-2012-2311 · published 11 May 2012
CVE-2012-2311: PHP-CGI query string option injection enables remote code execution
Php · Php
PHP versions before 5.3.13 and 5.4.x before 5.4.3, when run as a CGI script (php-cgi), mishandle query strings containing a %3D sequence without an equals sign. This lets remote attackers inject command-line options into the query string and execute arbitrary code. The flaw is an incomplete fix for CVE-2012-1823, so systems patched only for that earlier issue remain exposed.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution with a very high EPSS score and a known incomplete-fix bypass makes this an urgent patching priority.
What it is
PHP versions before 5.3.13 and 5.4.x before 5.4.3, when run as a CGI script (php-cgi), mishandle query strings containing a %3D sequence without an equals sign. This lets remote attackers inject command-line options into the query string and execute arbitrary code. The flaw is an incomplete fix for CVE-2012-1823, so systems patched only for that earlier issue remain exposed.
Impact
An unauthenticated remote attacker can execute arbitrary code with the privileges of the php-cgi process, leading to full compromise of the web server or application host.
Attack surface
Reached over the network via HTTP requests to a php-cgi endpoint; no authentication or user interaction is required, as reflected by the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high (0.69266, 99.3rd percentile), indicating strong likelihood of exploitation activity.
What to do
- Upgrade PHP to 5.3.13 or 5.4.3 or later, which contain the complete fix for CVE-2012-1823 and this bypass.
- If php-cgi cannot be patched immediately, disable the CGI SAPI and serve PHP through mod_php, php-fpm, or FastCGI instead.
- Apply the vendor patch referenced in the PHP bug 61910 patch-display link if upgrading is not possible.
- Restrict or block direct HTTP access to php-cgi binaries and remove any exposed cgi-bin PHP handlers.
- Monitor vendor advisories (Debian, openSUSE, Apple, HP) for platform-specific fixed packages and apply them.
Detection
- Inspect web and proxy logs for query strings containing %3D without an accompanying = character, especially with -d or other option-like tokens.
- Alert on requests to php-cgi or cgi-bin paths that include command-line option patterns such as -d, -s, or -n in the query string.
- Monitor php-cgi process behavior for unexpected child processes, file writes, or outbound connections following HTTP requests.
- Audit hosts for PHP versions below 5.3.13 or 5.4.3 running the CGI SAPI.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-2311 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-2311), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
