CVE-2012-1823 in php
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Affected software: php, fedoraproject fedora, debian linux, hp-ux, opensuse, suse linux enterprise server, suse linux enterprise software development kit, apple mac os x, redhat application stack, redhat gluster storage server for on-premise
Scores
- CVSS: 9.8 (critical)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-25
- Published: 2012-05-11
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.