CVE-2017-9841

9.8

CVSS
Critical

PUBLISHED

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data...

Exploited in the wild Remote Low complexity No user interaction

Vendor: PHPUnit
Product: PHPUnit
Published: Jun 27, 2017
EPSS: —

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "

php cisa nuclei_scanner

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation status

Exploited in the wild

Recorded 2022-02-15 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Feb 15, 2022

Scanner integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Chocapikk/CVE-2017-9841

github · Created 2023-08-27 21:20:19 UTC · 4 stars

PHPUnit RCE

MrG3P5/CVE-2017-9841

github · Created 2023-03-13 07:42:32 UTC · 4 stars

A Tool for scanning CVE-2017-9841 with multithread

dream434/CVE-2017-9841

github · Created 2022-11-21 16:36:48 UTC · 1 stars

CVE-2017-9841

jax7sec/CVE-2017-9841

github · Created 2022-04-20 07:01:20 UTC · 0 stars

CVE-2017-9841批量扫描及利用脚本。PHPUnit是其中的一个基于PHP的测试框架。 PHPUnit 4.8.28之前的版本和5.6.3之前的5.x版本中的Util/PHP/eval-stdin.php文件存在安全漏洞。远程攻击者可通过发送以‘<?php’字符串开头的HTTP POST数据利用该漏洞执行任意PHP代码。

p1ckzi/CVE-2017-9841

github · Created 2022-04-09 11:12:58 UTC · 2 stars

phpunit-shell | CVE_2017-9841

akr3ch/CVE-2017-9841

github · Created 2022-03-20 07:01:52 UTC · 2 stars

RCE exploit for PHP Unit 5.6.2

cyberharsh/Php-unit-CVE-2017-9841

github · Created 2020-06-24 09:37:04 UTC · 0 stars

mbrasile/CVE-2017-9841

github · Created 2020-01-06 23:27:15 UTC · 0 stars

CVE-2017-9841 detector script