Is CVE-2012-1823 being actively exploited?

Yes. CVE-2012-1823 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 25, 2022.

What is the CVSS score for CVE-2012-1823?

CVE-2012-1823 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2012-1823

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-77
EPSS score: 100.0% (100th percentile)
In CISA KEV: Yes, added March 25, 2022
In EU EUVD: Yes (EUVD-2012-1833)
Published: May 11, 2012
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

PHP-CGI Query String Parameter Vulnerability

Added to the KEV catalog on March 25, 2022; federal remediation due April 15, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2012-1833 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on November 4, 2025.

View on the EU Vulnerability Database

Affected products

apple / mac os x
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
hp / hp-ux
hp / hp-ux
opensuse / opensuse
opensuse / opensuse
php / php
redhat / application stack
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux workstation
redhat / enterprise linux workstation
redhat / gluster storage server for on-premise
redhat / storage
redhat / storage for public cloud
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise software development kit
suse / linux enterprise software development kit

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

SUSE Linux Enterprise Server 11 Service Pack 2 on IBM System z - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0852-2013 - archived
SUSE Linux Enterprise Server 11 Service Pack 2 including KVM virtualization - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0787-2013 - archived
Red Hat Enterprise Linux 5 OpenSSH-Server Cryptographic Module - Red Hat®, Inc. - FIPS 140 1384 - historical
Apple Mac OS X 10.6 - Apple Inc. - Common Criteria BSI-DSZ-CC-0536-2010 - archived

References

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/(Broken Link, Exploit)
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041(Broken Link)
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html(Mailing List, Third Party Advisory)
http://marc.info/?l=bugtraq&m=134012830914727&w=2(Mailing List)
http://rhn.redhat.com/errata/RHSA-2012-0546.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2012-0547.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2012-0568.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2012-0569.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2012-0570.html(Third Party Advisory)
http://secunia.com/advisories/49014(Broken Link)
http://secunia.com/advisories/49065(Broken Link)
http://secunia.com/advisories/49085(Broken Link)
http://secunia.com/advisories/49087(Broken Link)
http://support.apple.com/kb/HT5501(Third Party Advisory)
http://www.debian.org/security/2012/dsa-2465(Third Party Advisory)
http://www.kb.cert.org/vuls/id/520827(Exploit, Third Party Advisory, US Government Resource)
http://www.kb.cert.org/vuls/id/673343(Third Party Advisory, US Government Resource)
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068(Broken Link)
http://www.openwall.com/lists/oss-security/2024/06/07/1(Mailing List)
http://www.php.net/ChangeLog-5.php#5.4.2(Exploit, Patch, Release Notes)
http://www.php.net/archive/2012.php#id2012-05-03-1(Release Notes)
http://www.securitytracker.com/id?1027022(Broken Link, Third Party Advisory, VDB Entry)
https://bugs.php.net/bug.php?id=61910(Exploit, Patch)
https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1(Patch)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/(Mailing List, Release Notes)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/(Mailing List, Release Notes)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/(Mailing List, Release Notes)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain