CVE-2012-1823VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability

Affects PHP PHPSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2012-1823 (opens in a new tab)

Description

CVE-2012-1823 is a vulnerability in PHP when configured as a CGI script. It involves improper handling of query strings in the sapi/cgi/cgi_main.c component, enabling remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild and is considered high severity.

Summary

The vulnerability identified as CVE-2012-1823 affects the PHP interpreter when used as a CGI script. Specifically, the issue lies in the handling of query string parameters in the sapi/cgi/cgi_main.c source file. Improper processing of these parameters allows remote attackers to execute arbitrary code on the affected system. This vulnerability has been confirmed to be exploited in the wild, indicating active threat usage.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the target system running PHP as a CGI script. This can lead to full system compromise depending on the privileges of the PHP process.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should consult the PHP vendor advisories for updates. In the meantime, avoid running PHP as a CGI script or apply any recommended configuration changes from the vendor to mitigate the risk.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:55:57 UTC

Weaknesses

References

Related threats