CVE-2017-9841: PHPUnit Command Injection Vulnerability

Vulnerability summary

CVE-2017-9841 is a critical (CVSS 9.8) Code Injection vulnerability in PHPUnit. It is known to be exploited: CISA lists it, first on 15-02-2022. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-06-2017
   PublishedVulnerability first disclosed.
2. 15-02-2022
   Added to CISA KEVPHPUnit Command Injection Vulnerability
3. 15-08-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.