CVE-2012-2311
EXPLOITEDPHP < 5.3.13 and 5.4.x < 5.4.3 - Remote Code Execution via CGI Query String
Title source: llmExploitation Summary
CVE-2012-2311 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits.
AI-analyzed exploit summary This exploit leverages PHP CGI argument injection (CVE-2012-1823) by sending a crafted HTTP POST request with malicious query string parameters to enable remote code execution via PHP directives. The payload prepends arbitrary PHP code (phpinfo() in this case) to the executed script.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Exploits (4)
This exploit leverages PHP CGI argument injection (CVE-2012-1823) by sending a crafted HTTP POST request with malicious query string parameters to enable remote code execution via PHP directives. The payload prepends arbitrary PHP code (phpinfo() in this case) to the executed script.
This Metasploit module exploits CVE-2012-1823, a PHP CGI argument injection vulnerability, by leveraging the -d flag to manipulate php.ini directives and achieve remote code execution. It sends a crafted POST request with malicious PHP code in the body, which is executed due to the misconfigured directives.
This Python script exploits CVE-2012-2311, a remote code execution vulnerability in PHP CGI configurations. It crafts a malicious HTTP POST request to trigger command execution via PHP's CGI mode, supporting both direct command execution and reverse shell payloads.
This exploit targets a vulnerability in PHP CGI (CVE-2012-2311) by bypassing security checks via the -d flag to execute arbitrary PHP code. It sends a crafted POST request to the PHP CGI binary, allowing remote code execution through a reverse shell payload.