Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2012-1823 — PHP CGI Argument Injection. | Kitploit
Tools/GitHubGitHub/0xl0k1/cve-2012-1823
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHub0xl0k1/cve-2012-1823

CVE-2012-1823

PHP CGI Argument Injection.

View Repository
1213 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PHP CGI Argument Injection (CVE-2012-1823)

PHP CVE

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary > code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Usage

root@kitploit:~
./php_cgi.sh http://<RHOST> <COMMAND>

Example

root@kitploit:~
./php_cgi.sh http://10.128.20.2 "whoami"

Proof of concept

Download Tool