CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 25 Mar 2022, 3,605 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline 15 Apr 2022. Apply updates per vendor instructions.
- Which versions are affected?
Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: 15 April 2022.
Advisories and patches
- SSRT100856
- SUSE-SU-2012:0604
- HPSBMU02786
- MDVSA-2012:068
- openSUSE-SU-2012:0590
- RHSA-2012:0546
- RHSA-2012:0568
- RHSA-2012:0569
- RHSA-2012:0570
- SUSE-SU-2012:0598
- RHSA-2012:0547
- APPLE-SA-2012-09-19-2
Linked from CISA's catalog entry
Affected products and versions
The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2012-1823 to its Known Exploited Vulnerabilities (KEV) catalog on 25 Mar 2022.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 15 Apr 2022.
- The CVE record was published on 11 May 2012, 3,605 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 11 May 2012 | CVE record published |
| 25 Mar 2022 | Added to CISA KEV |
| 15 Apr 2022 | CISA due date for the required action |
| 4 Nov 2025 | CVE record last updated |
References
17 more in the CVE record.
More exploited PHP vulnerabilities
- CVE-2026-109618: PHP Memory Corruption Vulnerability
- CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
- CVE-2016-10033: PHPMailer Command Injection Vulnerability
- CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability
- CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability