漏洞描述
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2012-1823↗bugs.php.nethttps://bugs.php.net/bug.php?id=61910↗www.php.nethttp://www.php.net/ChangeLog-5.php#5.4.2↗h20000.www2.hp.comhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041↗