EXPLOIT/ALERT Back to feed

PHP-CGI Query String Parameter Vulnerability

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Published 2 Oct 2026Updated 2 Oct 20261723 sources
CVSS 9.8 ✓ VERIFIED REFERENCE△ CISA KEV
Overview Sources History

What happened

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Affected versions

PHP: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
Exploit-DB 29290Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Executionkingcope2013-10-29VerifiedExploit-DB 29316Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scannernoptrix2013-10-31VerifiedExploit-DB 18834PHP 5.3.12/5.4.2 - CGI Argument Injection (Metasploit)Metasploit2012-05-04VerifiedExploit-DB 18836PHP < 5.3.12 / < 5.4.2 - CGI Argument Injectionrayh4c2012-05-05VerifiedSploitusRemote code execution in PHP 5.2.4-2ubuntu5.10 under Apache 2.2.8 via CGI argument injection.mujtaba8152026-10-02T13:32:38VerifiedPoC-in-GitHub · mujtaba815/metasploitable2-php-cgi-exploitExploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation★ 2mujtaba8152026-10-02CandidatePoC-in-GitHub · drone789/CVE-2012-1823★ 1drone7892015-09-08CandidatePoC-in-GitHub · tardummy01/oscp_scripts-1First script, pgp-cgi-cve-2012-1823 BASH script★ 3tardummy012017-10-01CandidatePoC-in-GitHub · Unix13/metasploitable2PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon, misconfigured NFS files, etc.★ 4Unix132019-07-05CandidatePoC-in-GitHub · cyberharsh/PHP_CVE-2012-1823★ 1cyberharsh2020-08-17CandidatePoC-in-GitHub · 0xl0k1/CVE-2012-1823PHP CGI Argument Injection.★ 120xl0k12023-08-24CandidatePoC-in-GitHub · Jimmy01240397/CVE-2012-1823-Analyze★ 0Jimmy012403972024-12-09CandidatePoC-in-GitHub · Dmitri131313/CVE-2012-1823-exploit-for-https-user-password-webCVE-2012-1823 exploit for https user password website.★ 1Dmitri1313132025-03-20CandidatePoC-in-GitHub · nulltrace1336/PHP-CGI-Argument-Injection-ExploitUshbu videoda Kali Linux orqali Metasploitable 2 serveriga PHP CGI Argument Injection (CVE-2012-1823) ekspluatatsiyasi Metasploit yordamida amalga oshiriladi★ 0nulltrace13362025-12-24CandidatePoC-in-GitHub · waburig/Open-Worldwide-Application-Security-Project-OWASP-Automated Web Vulnerability Assessment of DVWA using OWASP ZAP to identify and analyze critical security flaws like Remote Code Execution (CVE-2012-1823).★ 0waburig2026-01-02CandidatePoC-in-GitHub · hackherMind-Pixel/Vulnerable-Lab-ExploitationA hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.★ 1hackherMind-Pixel2026-01-22CandidatePoC-in-GitHub · tryj/CVE-2012-1823---PHP-CGI---RCE★ 0tryj2026-04-03CandidatePoC-in-GitHub · mehedi-hasan-sami98/DVWA-ZAP-PENTESTWeb application security assessment of DVWA using OWASP ZAP — vulnerability scanning, RCE (CVE-2012-1823) analysis, and remediation report.★ 0mehedi-hasan-sami982026-07-11CandidatePoC-in-GitHub · tanasescualexandrugabriel/Vulnerability-Assessment-and-OSINT-CVE-2012-1823This repository documents the process of identifying, analyzing, and gathering Open Source Intelligence (OSINT) on a specific security vulnerability detected during a target network scan.★ 0tanasescualexandrugabriel2026-07-22CandidatePoC-in-GitHub · yilmaz8596/metasploitable-vulnerability-assessmentInfrastructure penetration-testing lab demonstrating reconnaissance, CVE-2012-1823 exploitation, initial access, and privilege-escalation investigation.★ 0yilmaz85962026-10-03CandidatePoC-in-GitHub · CyberCTF/vulhub-php-cve-2012-1823Vulhub php/CVE-2012-1823: PHP-CGI Query String Argument Injection (CVE-2012-1823), run with Isoloom★ 0CyberCTF2026-10-08Candidate
CorrectionsReport an issue