The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.

CPENameOperatorVersion
parallels:parallels_plesk_panelparallels parallels plesk paneleq9.0
parallels:parallels_plesk_panelparallels parallels plesk paneleq9.2
parallels:parallels_small_business_panelparallels parallels small business paneleq10.0

CPE	Name	Operator	Version
parallels:parallels_plesk_panel	parallels parallels plesk panel	eq	9.0
parallels:parallels_plesk_panel	parallels parallels plesk panel	eq	9.2
parallels:parallels_small_business_panel	parallels parallels small business panel	eq	10.0

References

kb.parallels.com/116241

seclists.org/fulldisclosure/2013/Jun/21

www.kb.cert.org/vuls/id/673343

nessus 38

attackerkb 2

prion 4

openvas 60

checkpoint_advisories 1

symantec 1

thn 4

cert 2

saint 4

amazon 1

centos 3

redhat 6

threatpost 11

exploitpack 3

seebug 7

packetstorm 6

cisa_kev 1

metasploit 1

freebsd 2

veracode 5

oraclelinux 2

zdt 1

canvas 1

nuclei 1

cve 3

securityvulns 1

exploitdb 5

suse 4

fedora 12

ubuntu 1

ubuntucve 3

debian 1

nmap 1

osv 1

nessus

Plesk Panel Apache Arbitrary PHP Code Injection

2013-06-07 00:00:00

Oracle Linux 5 : php53 (ELSA-2012-0547)

2013-07-12 00:00:00

Oracle Linux 5 / 6 : php (ELSA-2012-0546)

2013-07-12 00:00:00

attackerkb

CVE-2013-4878

2013-07-18 00:00:00

CVE-2012-1823

2012-05-11 00:00:00

prion

Default configuration

2013-07-18 16:51:00

Design/Logic Flaw

2012-05-11 10:15:00

Design/Logic Flaw

2012-05-11 10:15:00

openvas

Plesk < 11.0.9 Multiple Vulnerabilities

2013-06-06 00:00:00

RedHat Update for php53 RHSA-2012:0547-01

2012-05-08 00:00:00

Mandriva Update for php MDVSA-2012:068 (php)

2012-08-03 00:00:00

checkpoint_advisories

PHP php-cgi Query String Parameter Code Execution (CVE-2012-1823; CVE-2012-2311; CVE-2012-2335; CVE-2012-2336; CVE-2013-4878)

2012-05-14 00:00:00

symantec

PHP 'php-cgi' Information Disclosure Vulnerability

2012-05-04 00:00:00

thn

Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability

2013-11-30 09:08:00

Un-Patched PHP-CGI remote code execution vulnerability can expose Source Codes

2012-05-03 16:55:00

Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability

2013-11-30 20:08:00

cert

Parallels Plesk Panel phppath/php vulnerability

2013-06-07 00:00:00

PHP-CGI query string parameter vulnerability

2012-05-03 00:00:00

saint

PHP CGI Query String Parameters Command Execution

2012-05-15 00:00:00

PHP CGI Query String Parameters Command Execution

2012-05-15 00:00:00

PHP CGI Query String Parameters Command Execution

2012-05-15 00:00:00

amazon

Critical: php

2012-05-09 14:54:00

centos

php security update

2012-05-07 21:09:19

php53 security update

2012-05-07 23:01:16

php security update

2012-06-27 20:21:47

redhat

(RHSA-2012:0569) Critical: php53 security update

2012-05-10 00:00:00

(RHSA-2012:0568) Critical: php security update

2012-05-10 00:00:00

(RHSA-2012:0546) Critical: php security update

2012-05-07 00:00:00

threatpost

Apple Fixes Serious Flaws in iOS 5.1.1

2012-05-08 13:49:34

Leaders from China, U.S. Meet, Agree to Rally Against Cyber Threats

2012-05-08 17:24:22

Exploits for Two-Year-Old PHP Security Vulnerability Found

2014-03-19 12:12:20

exploitpack

Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution

2013-10-29 00:00:00

PHP 5.3.12 5.4.2 - CGI Argument Injection

2012-05-05 00:00:00

Plesk 9.5.4 - Remote Command Execution

2013-06-05 00:00:00

seebug

PHP-CGI Argument Injection Remote Code Execution

2012-12-25 00:00:00

PHP CGI Argument Injection Exploit

2014-07-01 00:00:00

PHP CGI Argument Injection

2014-07-01 00:00:00

packetstorm

Apache + PHP 5.x Remote Code Execution Python Exploit #2

2013-10-31 00:00:00

PHP CGI Argument Injection

2012-05-22 00:00:00

PHP-CGI Argument Injection Remote Code Execution

2012-12-24 00:00:00

cisa_kev

PHP-CGI Query String Parameter Vulnerability

2022-03-25 00:00:00

metasploit

PHP CGI Argument Injection

2012-05-09 16:01:15

freebsd

php -- vulnerability in certain CGI-based setups

2012-05-03 00:00:00

php -- multiple vulnerabilities

2012-05-08 00:00:00

veracode

Arbitrary Code Execution

2019-01-15 08:51:10

Denial Of Service (DoS)

2019-05-02 04:42:12

Denial Of Service (DoS) Or Directory Traversal

2019-05-02 04:42:12

oraclelinux

php53 security update

2012-05-07 00:00:00

php security update

2012-05-07 00:00:00

zdt

Apache Magicka Remote Code Execution Vulnerability

2013-10-31 00:00:00

canvas

Immunity Canvas: PHP_CGI_REMOTE

2012-05-11 10:15:00

nuclei

PHP CGI v5.3.12/5.4.2 Remote Code Execution

2021-07-20 09:32:27

cve

CVE-2012-1823

2012-05-11 10:15:00

CVE-2012-2311

2012-05-11 10:15:00

CVE-2012-2336

2012-05-11 10:15:00

securityvulns

PHP CGI Argument Injection Remote Exploit V0.3 - PHP Version

2012-05-24 00:00:00

exploitdb

Plesk < 9.5.4 - Remote Command Execution

2013-06-05 00:00:00

Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution

2013-10-29 00:00:00

PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection

2012-05-05 00:00:00

suse

update for php5 (critical)

2012-05-07 16:08:55

Security update for PHP5 (critical)

2012-05-09 02:08:18

Security update for PHP5 (critical)

2012-05-09 22:08:16

fedora

[SECURITY] Fedora 16 Update: maniadrive-1.2-32.fc16.5

2012-05-27 01:52:21

[SECURITY] Fedora 16 Update: php-5.3.13-1.fc16

2012-05-27 01:52:21

[SECURITY] Fedora 16 Update: php-eaccelerator-0.9.6.1-9.fc16.5

2012-05-27 01:52:21

ubuntu

PHP vulnerability

2012-05-04 00:00:00

ubuntucve

CVE-2012-1823

2012-05-03 00:00:00

CVE-2012-2311

2012-05-04 00:00:00

CVE-2012-2336

2012-05-11 00:00:00

debian

[SECURITY] [DSA 2465-1] php5 security update

2012-05-09 17:23:53

nmap

http-vuln-cve2012-1823 NSE Script

2012-05-08 05:56:04

osv

php5 - several

2012-05-09 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.041 Low

EPSS

Percentile

92.1%

JSON

Related for CVE-2013-4878

nessus38 attackerkb2 prion4 openvas60 checkpoint_advisories1 symantec1 thn4 cert2 saint4 amazon1 centos3 redhat6 threatpost11 exploitpack3 seebug7 packetstorm6 cisa_kev1 metasploit1 freebsd2 veracode5 oraclelinux2 zdt1 canvas1 nuclei1 cve3 securityvulns1 exploitdb5 suse4 fedora12 ubuntu1 ubuntucve3 debian1 nmap1 osv1