PHP Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2012-2311 - Vulnerability Database

PHP

PHP Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2012-2311

High

Reference: CVE-2012-2311

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2012-2311

Title: PHP Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability

Overview:

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3 when configured as a CGI script (aka php-cgi) does not properly handle query strings that contain a 3D sequence but no (equals sign) character which allows remote attackers to execute arbitrary code by placing command-line options in the query string related to lack of skipping a certain php_getopt for the 39d39 case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.