NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2017-9841

PHPUnit Command Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-02-15. Federal due date: 2022-08-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Affected products

VendorProductAffected versions
Phpunit ProjectPhpunit
through 4.8.27
from 5.0.0 before 5.6.3
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.5.0

Weakness classification

CWE-94

References