CVE-2012-2336
EXPLOITEDPHP < 5.3.13 and 5.4.x < 5.4.3 - Denial of Service via Malformed CGI Query String
Title source: llmExploitation Summary
CVE-2012-2336 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including kingcope, rayh4c, Metasploit.
AI-analyzed exploit summary This exploit targets a vulnerability in PHP CGI (CVE-2012-2311) by bypassing security checks via command-line arguments (-d) to execute arbitrary PHP code. It sends a crafted POST request to the PHP CGI binary, disabling security settings and executing a reverse shell payload.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Exploits (4)
This exploit targets a vulnerability in PHP CGI (CVE-2012-2311) by bypassing security checks via command-line arguments (-d) to execute arbitrary PHP code. It sends a crafted POST request to the PHP CGI binary, disabling security settings and executing a reverse shell payload.
This exploit leverages PHP CGI argument injection (CVE-2012-1823) by sending a crafted HTTP POST request with malicious query parameters to enable remote code execution via PHP directives. The payload prepends arbitrary PHP code (phpinfo() in this case) to demonstrate the vulnerability.
This exploit leverages a PHP CGI argument injection vulnerability (CVE-2012-1823) to achieve remote code execution by manipulating PHP directives via the -d flag. It sends a crafted POST request with malicious PHP code in the body, exploiting improper handling of query strings.
This exploit targets a vulnerability in Apache with PHP 5.* via CGI misconfiguration, allowing remote code execution. It includes functionality for vulnerability scanning, command execution, and reverse shell establishment.