CVE-2012-1823 in Parallels Plesk

요약 (영어)

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

예약하다

2012. 03. 21.

공개

2012. 05. 11.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
9012	Parallels Plesk Request php 권한 상승	77	공격당한	공식 수정	CVE-2012-1823
5319	PHP cgi_main.c 권한 상승	77	공격당한	공식 수정	CVE-2012-1823