CVE-2012-2336
EXPLOITEDPHP <5.3.13 & <5.4.3 - DoS
Title source: llmDescription
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Exploits (4)
exploitdb
WORKING POC
VERIFIED
by rayh4c · pythonremotephp
https://www.exploit-db.com/exploits/18836
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/18834
References (8)
Scores
EPSS
0.4733
EPSS Percentile
97.7%
Details
VulnCheck KEV
2018-01-15
CWE
CWE-20
Status
published
Products (46)
php/php
1.0
php/php
2.0
php/php
2.0b10
php/php
3.0
php/php
3.0.1
php/php
3.0.2
php/php
3.0.3
php/php
3.0.4
php/php
3.0.5
php/php
3.0.6
... and 36 more
Published
May 11, 2012
Tracked Since
Feb 18, 2026