PHP CGI Argument Injection — اجرای کد از راه دور

A critical argument injection vulnerability in PHP CGI mode on Windows allows unauthenticated remote code execution, bypassing the fix for CVE-2012-1823.

## Vulnerability Overview
When PHP is running in CGI mode on Windows, the PHP-CGI binary incorrectly handles certain Unicode character sequences in the query string. An attacker can inject PHP-CGI arguments (such as `-d allow_url_include=1`) by exploiting Windows' Best-Fit character encoding conversion, bypassing the CVE-2012-1823 fix.

## Technical Details
- **Type:** Argument Injection (CWE-88)
- **Root Cause:** Windows' Best-Fit encoding converts certain Unicode characters (e.g., soft hyphen `0xAD`) to ASCII hyphen `-`, allowing injection of PHP-CGI command-line arguments through the URL query string.
- **Affected Configurations:** PHP in CGI mode (php-cgi.exe), XAMPP default installations, IIS with PHP CGI handler.
- **Bypass Mechanism:** The original CVE-2012-1823 fix checks for `-` at the start of query string, but the Unicode bypass evades this check.

## Exploitation in the Wild
- Actively exploited within 24 hours of disclosure.
- Used by multiple threat actors including ransomware groups.
- XAMPP installations on Windows are particularly vulnerable by default.
- Metasploit module available and widely used.

## Affected Versions
- PHP 8.1.x before 8.1.29
- PHP 8.2.x before 8.2.20
- PHP 8.3.x before 8.3.8
- All PHP 7.x versions (EOL, no patch)