⚠ Actively exploited
Added to CISA KEV on 2022-02-15. Federal agencies required to patch by 2022-08-15. Required action: Apply updates per vendor instructions..
CVE-2017-9841 — Code Injection in Project Phpunit
Severity
9.8CRITICALNVD
EPSS
94.2%
top 0.08%
CISA KEV
KEV
Added 2022-02-15
Due 2022-08-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJun 27
KEV addedFeb 15
KEV dueAug 15
Latest updateDec 18
CISA Required Action: Apply updates per vendor instructions.
Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages6 packages
Patches
🔴Vulnerability Details
11💥Exploits & PoCs
2Nuclei▶
PHPUnit - Remote Code Execution
📋Vendor Advisories
5Debian▶
CVE-2017-9841: phpunit - Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows rem...↗2017
🕵️Threat Intelligence
1Unit42
▶