PHPUnit · PHPUnit
CVE-2017-9841
PHPUnit Command Injection Vulnerability
What it is
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CISA: PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: August 15, 2022
- Added to the CISA list
- February 15, 2022
- Published
- June 27, 2017
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (7)
- https://security.gentoo.org/glsa/201711-15
- http://www.securityfocus.com/bid/101798
- http://www.securitytracker.com/id/1039812
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
- https://github.com/sebastianbergmann/phpunit/pull/1956
- http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.