CVE-2012-2335
HP Security Bulletin HPSBMU02900
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
php-wrapper.fcgi no maneja apropiadamente argumentos de línea de comandos, lo que permite a atacantes remotos evitar mecanismos de protección de PHP 5.3.12 y 5.4.2 y ejecutar código arbitrario utilizando una interacción inapropiada entre el componente PHP sapi/cgi/cgi_main.c y una cadena de petición que comienza con una secuencia +-.
Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in Local Denial of Service (DoS), remote Denial of Service (DoS), execution of arbitrary code, gain privileges, disclosure of information, unauthorized access, or XSS. Revision 1 of this advisory.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-04-19 CVE Reserved
- 2012-05-11 CVE Published
- 2024-08-06 CVE Updated
- 2025-04-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823 | X_refsource_misc | |
| http://git.php.net/?p=php-src.git%3Ba=blob%3Bf=sapi/cgi/cgi_main.c%3Bh=a7ac26f0#l1569 | X_refsource_misc | |
| http://secunia.com/advisories/49014 | Third Party Advisory | |
| http://www.kb.cert.org/vuls/id/520827 | Third Party Advisory |
|
| http://www.php.net/archive/2012.php#id2012-05-06-1 | X_refsource_misc | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/75652 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.3.12 Search vendor "Php" for product "Php" and version "5.3.12" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.4.2 Search vendor "Php" for product "Php" and version "5.4.2" | - |
Affected
| ||||||