CVE-2012-1823 PHP
An exploited vulnerability CISA catalogued on 25 March 2022 in PHP, and this page follows how many of the Arabian Gulf's sites still announce an affected version with every census.
Exposure today
Catalogued on 25 March 2022
- 0.3% of the Arabian Gulf's sites announcing a full PHP version announce an affected one 3 of 1,097 announcing a full version Measured on 23 October 2026 by reading the first page of every live domain in the Arabian Gulf, and 10,101 websites answered.
PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Each state has its own figure on its own page, never set beside another.
The series
Every census since the index began following this vulnerability, newest first.
- 0.3% 23 October 2026 3 of 1,097 announcing a full version
Affected versions
As NVD gives them, and what each site announces is held against them.
- PHP v < 5.3.12
- PHP 5.4.0 ≤ v < 5.4.2
The fix is to move PHP to a version outside these ranges, or apply what its maker advises, and then stop announcing the version in the site's headers.
CISA set 15 April 2022 as the deadline for US federal agencies to fix it.
How to cite
0.3% of the sites in the Arabian Gulf announcing a full PHP version announce one affected by the exploited vulnerability CVE-2012-1823
Source: Gulf Cybersecurity Baseline, readiness index, census of 23 October 2026, https://gbaseline.3li.info/en/readiness/cve-2012-1823/
0.3٪ من مواقع الخليج العربي التي تعلن إصدار PHP كاملاً تعلن إصداراً مصاباً بالثغرة المستغلة CVE-2012-1823
المصدر خط الأساس الخليجي للأمن السيبراني مؤشر الاستعدادية بقياس 23 أكتوبر 2026 على https://gbaseline.3li.info/readiness/cve-2012-1823/