php-cgi query string injection
When PHP runs as a CGI script, a query string without an equals sign can be read as command-line options, allowing remote code execution.
- Severity
- Critical
- Published
- 11 May 2012
- Added to CISA KEV
- 25 March 2022
Affected configurations
PHP configured as php-cgi, before 5.3.12 and 5.4.x before 5.4.2. CVE-2024-4577 later bypassed the protection added for this issue on Windows.
Vulnerable versions: PHP before 5.3.12, and 5.4 before 5.4.2, configured as php-cgi.
How it works
When PHP runs as a CGI script (php-cgi), a query string that lacks an equals sign can be treated as command-line options to PHP. A remote attacker can place options in the query string and execute arbitrary code.
Base score: 9.8 Critical (CVSS 3.1, CISA-ADP score shown on NVD).
Related: PHP-CGI argument injection on Windows. CVE-2024-4577 later bypassed the protection added for this issue on Windows.
Fixed versions
Upstream releases from the PHP project. Distribution and LTS packages carry their own version numbers.
| Branch | Fixed in |
|---|---|
| PHP 5.4 | 5.4.2 |
| PHP 5.3 | 5.3.12 |
What to check
- Find any site where the web server runs PHP through php-cgi.
- Any PHP 5.x runtime is long past end of life. Treat it as needing a migration plan, not only this fix.
- CISA lists this vulnerability as known to be exploited. Exposed servers should be reviewed for signs of compromise.
Need this checked across your servers? A PHP response assessment records the runtime serving each site and its patch status, in writing.
Sources
Reviewed 22 October 2026.
- NVD entrynvd.nist.gov
- CISA KEV catalogwww.cisa.gov