OpenVAS found a vulnerability where it points to PHP versions 5.4.3 and 5.3.13. But both the two hosts I checked with OpenVAS are running PHP 7.2.x. Would this vulnerability be a false positive?
High (CVSS: 7.5)
NVT: PHP-CGI-based setups vulnerability when parsing query string parameters from ph... (OID: 220.127.116.11.4.1.25618.104.22.168482)
PHP is prone to an information-disclosure vulnerability.
Vulnerability Detection Result
Vulnerable URL: http://domain:port/
Solution type: VendorFix
PHP has released version 5.4.3 and 5.3.13 to address this vulnerability. PHP is recommending that users upgrade to the latest version of PHP.
When PHP is used in a CGI-based setup (such as Apache's mod_cgid), the php-cgi receives a processed query string parameter as command line arguments which allows command-line switches, such as -s, -d or -c to be passed to the php-cgi binary, which can be exploited to disclose source code and obtain arbitrary code execution.
An example of the -s command, allowing an attacker to view the source code of index.php is below:
Vulnerability Detection Method
Details: PHP-CGI-based setups vulnerability when parsing query string parameters from ph... (OID: 22.214.171.124.4.1.256126.96.36.199482)
Version used: 2019-11-08T10:10:55+0000
CVE: CVE-2012-1823, CVE-2012-2311, CVE-2012-2336, CVE-2012-2335