Every CVE Search/ Get API key

CVE-2017-9841

Code Injection in PHPUnit

9.8 CriticalIn KEVPublic exploitFix available

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 92.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
CVE-2017-9841
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
CVE-2017-9841
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2022-1528 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
EUVD-2022-1528
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r7c9-c69m-rph8 9.8

Code Injection in PHPUnit

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
GHSA-r7c9-c69m-rph8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02
CISA KEV No score

PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
CVE-2017-9841
Weakness
CWE-94
Updated
2026-11-02
OSV 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
CVE-2017-9841
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2017-9841 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
DEBIAN-CVE-2017-9841
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-r7c9-c69m-rph8 9.8

Code Injection in PHPUnit

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
GHSA-r7c9-c69m-rph8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02
OSVUBUNTU-CVE-2017-9841 9.8

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Record
UBUNTU-CVE-2017-9841
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0429 No score

Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping (CVE-2017-8808).

Reflected File Download from api.php (CVE-2017-8809).

On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password (CVE-2017-8810).

It's possible to mangle HTML via raw message parameter expansion (CVE-2017-8811).

The id attribute on headlines allow raw > (CVE-2017-8812).

Language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition (CVE-2017-8814).

Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815).

composer.json has require-dev versions of PHPUnit with known security issues (CVE-2017-9841).

Note that MediaWiki 1.23.x on Mageia 5 is no longer supported. Those using the mediawiki package on Mageia 5 should upgrade to Mageia 6.

Record
MGASA-2017-0429
Updated
2026-11-02
OSVUSN-7171-1 No score

phpunit vulnerability

It was discovered that PHPUnit incorrectly handled web requests if exposed to the internet. An attacker could possibly use this issue to achive remote code execution or obtain sensitive information.

Record
USN-7171-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phpunit/phpunit
Packagist
 4.8.19 up to 4.8.28
4.8.28
phpunit/phpunit
Packagist
 5.0.10 up to 5.6.3
5.6.3
phpunit
Debian:12
 before 5.4.6-2
5.4.6-2
phpunit
Debian:13
 before 5.4.6-2
5.4.6-2
phpunit
Debian:14
 before 5.4.6-2
5.4.6-2
phpunit/phpunit
Packagist
 4.8.19 up to 4.8.28, plus listed versions
4.8.204.8.214.8.224.8.234.8.244.8.254.8.264.8.27
4.8.28
phpunit/phpunit
Packagist
 5.0.10 up to 5.6.3, plus listed versions
5.1.05.1.15.1.25.1.35.1.4
Show 42 moreShow less
5.1.55.1.65.1.75.2.05.2.15.2.105.2.115.2.125.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.15.3.25.3.35.3.45.3.55.4.05.4.15.4.25.4.35.4.45.4.55.4.65.4.75.4.85.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.75.6.05.6.15.6.2
5.6.3
mediawiki
Mageia:6
 before 1.27.4-1.mga6
1.27.4-1.mga6
phpunit
Ubuntu:Pro:16.04:LTS
 before 5.1.3-1+ubuntu3+esm1, plus listed versions
4.7.6-14.8.16-15.1.3-1ubuntu15.1.3-1+build15.1.3-1+ubuntu15.1.3-1+ubuntu3
5.1.3-1+ubuntu3+esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmbrasile/CVE-2017-98412020-01-06
PoC in GitHubRandomRobbieBF/phpunit-brute2020-05-18
PoC in GitHubcyberharsh/Php-unit-CVE-2017-98412020-06-24
PoC in GitHubludy-dev/PHPUnit_eval-stdin_RCE2020-09-14
PoC in GitHubincogbyte/laravel-phpunit-rce-masscaner2021-07-04
Exploit-DBPHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)2022-02-02
PoC in GitHubakr3ch/CVE-2017-98412022-03-20
PoC in GitHubp1ckzi/CVE-2017-98412022-04-09
PoC in GitHubjax7sec/CVE-2017-98412022-04-20
PoC in GitHubmileticluka1/eval-stdin2022-10-20
Show 10 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubdream434/CVE-2017-98412022-11-21
PoC in GitHubMadExploits/PHPunit-Exploit2022-12-07
PoC in GitHubMrG3P5/CVE-2017-98412023-03-13
PoC in GitHubChocapikk/CVE-2017-98412023-08-27
PoC in GitHubjoelindra/CVE-2017-98412025-04-22
PoC in GitHubdrcrypterdotru/PHPUnit-GoScan2025-08-30
PoC in GitHubkrisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC2026-06-11
PoC in GitHubCheLover86/CVE-2017-98412026-10-01
PoC in GitHubCyberCTF/vulhub-phpunit-cve-2017-98412026-10-08
NucleiPHPUnit - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9841 is a critical vulnerability (CVSS 9.8) in Phpunit, published June 27, 2017. CISA lists it as known to be exploited, since February 15, 2022. EUVD reports exploitation since February 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in phpunit/phpunit 4.8.28.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open