CVE-2017-9841
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/Third Party Advisory
- securityfocus.com/bid/101798Broken Link
- securitytracker.com/id/1039812Broken Link
- github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5PatchThird Party Advisory
- github.com/sebastianbergmann/phpunit/pull/1956PatchThird Party Advisory
- security.gentoo.org/glsa/201711-15Third Party Advisory
- oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1533 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-94
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.