PHP-CGI vulnerability - exploits in the wild and Snort coverage

Summary: Cisco Talos reported on CVE-2012-1823, a PHP-CGI command-line parameter vulnerability released the previous Thursday that is now being actively exploited in the wild and has a Metasploit module. When PHP runs in CGI mode, certain arguments are not escaped before reaching the PHP binary, so the "-s" flag can disclose source code and the "-d" flag combined with "auto_prepend_file" can achieve arbitrary command execution.
What you should know: Exploitation requires a non-default CGI wrapper configuration, but where it applies the outcome is source code disclosure or remote code execution, and a working Metasploit module means the barrier to attack is low.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2012-1823
Related: Network Attack Trends: Internet of Threats (August-October 2020) Cyber Risks ·
CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022
Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020) Cyber Risks ·