CVE-2012-1823

A PHP CGI vulnerability allowed remote attackers to execute arbitrary code via improperly handled query strings.

When PHP is configured as a CGI script, attackers can inject malicious code through query strings, leading to remote code execution. DIB organizations must ensure PHP is patched and not run in CGI mode without strict input validation, as this flaw was actively exploited in the wild.

Shame score — A long-standing, actively exploited vulnerability in a widely used language that enabled remote code execution without requiring a zero-day exploit.