{"cvss":0.0,"datePublished":"2012-05-09T00:00:00Z","dateUpdated":"2012-05-09T00:00:00Z","description":"sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.","dueDate":"","id":"CVE-2012-2311","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"PHP","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"PHP PHP Improper Neutralization of Special Elements used in an SQL Command","vendor":"PHP"}