EDB-29316

PoC

Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner

view exploit source exploit_dbtype remoteauthor noptrixpublished 2013-10-31catalog exploit_db

exploited CVEs (3)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2012-2336US	medium5.0	50.3% (99th)	Exploit	2012-05-11
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign)…
CVE-2012-2311US	high7.5	69.3% (99th)	Exploit	2012-05-11
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence b…
CVE-2012-1823US	high7.5OT critical	100.0% (100th)	KEV	2012-05-11
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign)…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.