{"id":"CVE-2017-9841","aliases":["DEBIAN-CVE-2017-9841","EUVD-2022-1528","GHSA-r7c9-c69m-rph8","MGASA-2017-0429","UBUNTU-CVE-2017-9841","USN-7171-1"],"status":"published","title":"Code Injection in PHPUnit","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99999,"percentile":0.99994,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2017-06-27T17:00:00Z","modified":"2026-10-24T10:49:31Z","kev":{"date_added":"2022-02-15","due_date":"2022-08-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-02-15"},{"source":"kev","since":"2022-02-15"}],"exploits":[{"source":"pocgithub","id":"mbrasile/CVE-2017-9841","title":"mbrasile/CVE-2017-9841","date":"2020-01-06","url":"https://github.com/mbrasile/CVE-2017-9841"},{"source":"pocgithub","id":"RandomRobbieBF/phpunit-brute","title":"RandomRobbieBF/phpunit-brute","date":"2020-05-18","url":"https://github.com/RandomRobbieBF/phpunit-brute"},{"source":"pocgithub","id":"cyberharsh/Php-unit-CVE-2017-9841","title":"cyberharsh/Php-unit-CVE-2017-9841","date":"2020-06-24","url":"https://github.com/cyberharsh/Php-unit-CVE-2017-9841"},{"source":"pocgithub","id":"ludy-dev/PHPUnit_eval-stdin_RCE","title":"ludy-dev/PHPUnit_eval-stdin_RCE","date":"2020-09-14","url":"https://github.com/ludy-dev/PHPUnit_eval-stdin_RCE"},{"source":"pocgithub","id":"incogbyte/laravel-phpunit-rce-masscaner","title":"incogbyte/laravel-phpunit-rce-masscaner","date":"2021-07-04","url":"https://github.com/incogbyte/laravel-phpunit-rce-masscaner"},{"source":"exploitdb","id":"EDB-50702","title":"PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)","type":"webapps","platform":"php","date":"2022-02-02","url":"https://www.exploit-db.com/exploits/50702"},{"source":"pocgithub","id":"akr3ch/CVE-2017-9841","title":"akr3ch/CVE-2017-9841","date":"2022-03-20","url":"https://github.com/akr3ch/CVE-2017-9841"},{"source":"pocgithub","id":"p1ckzi/CVE-2017-9841","title":"p1ckzi/CVE-2017-9841","date":"2022-04-09","url":"https://github.com/p1ckzi/CVE-2017-9841"},{"source":"pocgithub","id":"jax7sec/CVE-2017-9841","title":"jax7sec/CVE-2017-9841","date":"2022-04-20","url":"https://github.com/jax7sec/CVE-2017-9841"},{"source":"pocgithub","id":"mileticluka1/eval-stdin","title":"mileticluka1/eval-stdin","date":"2022-10-20","url":"https://github.com/mileticluka1/eval-stdin"},{"source":"pocgithub","id":"dream434/CVE-2017-9841","title":"dream434/CVE-2017-9841","date":"2022-11-21","url":"https://github.com/dream434/CVE-2017-9841"},{"source":"pocgithub","id":"MadExploits/PHPunit-Exploit","title":"MadExploits/PHPunit-Exploit","date":"2022-12-07","url":"https://github.com/MadExploits/PHPunit-Exploit"},{"source":"pocgithub","id":"MrG3P5/CVE-2017-9841","title":"MrG3P5/CVE-2017-9841","date":"2023-03-13","url":"https://github.com/MrG3P5/CVE-2017-9841"},{"source":"pocgithub","id":"Chocapikk/CVE-2017-9841","title":"Chocapikk/CVE-2017-9841","date":"2023-08-27","url":"https://github.com/Chocapikk/CVE-2017-9841"},{"source":"pocgithub","id":"joelindra/CVE-2017-9841","title":"joelindra/CVE-2017-9841","date":"2025-04-22","url":"https://github.com/joelindra/CVE-2017-9841"},{"source":"pocgithub","id":"drcrypterdotru/PHPUnit-GoScan","title":"drcrypterdotru/PHPUnit-GoScan","date":"2025-08-30","url":"https://github.com/drcrypterdotru/PHPUnit-GoScan"},{"source":"pocgithub","id":"krisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC","title":"krisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC","date":"2026-06-11","url":"https://github.com/krisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC"},{"source":"pocgithub","id":"CheLover86/CVE-2017-9841","title":"CheLover86/CVE-2017-9841","date":"2026-10-01","url":"https://github.com/CheLover86/CVE-2017-9841"},{"source":"pocgithub","id":"CyberCTF/vulhub-phpunit-cve-2017-9841","title":"CyberCTF/vulhub-phpunit-cve-2017-9841","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-phpunit-cve-2017-9841"},{"source":"nuclei","id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"phpunit/phpunit","fixed_in":["4.8.28","5.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"phpunit","fixed_in":["5.4.6-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpunit","fixed_in":["5.4.6-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpunit","fixed_in":["5.4.6-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpunit","fixed_in":["5.1.3-1+ubuntu3+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpunit/phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.19"},{"fixed":"4.8.28"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpunit/phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.10"},{"fixed":"5.6.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.6-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.6-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.6-2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpunit/phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.19"},{"fixed":"4.8.28"}]}],"versions":["4.8.19","4.8.20","4.8.21","4.8.22","4.8.23","4.8.24","4.8.25","4.8.26","4.8.27"]},{"source":"osv","ecosystem":"Packagist","package":"phpunit/phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.10"},{"fixed":"5.6.3"}]}],"versions":["5.0.10","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","5.4.8","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.6.0","5.6.1","5.6.2"]},{"source":"osv","ecosystem":"Mageia:6","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-1+ubuntu3+esm1"}]}],"versions":["4.7.6-1","4.8.16-1","5.1.3-1ubuntu1","5.1.3-1+build1","5.1.3-1+ubuntu1","5.1.3-1+ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-1+ubuntu3+esm1"}]}],"versions":["4.7.6-1","4.8.16-1","5.1.3-1ubuntu1","5.1.3-1+build1","5.1.3-1+ubuntu1","5.1.3-1+ubuntu3"]}],"products":[{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"phpunit","product":"phpunit"},{"vendor":"phpunit_project","product":"phpunit"}],"references":[{"url":"http://www.securityfocus.com/bid/101798","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"http://www.securitytracker.com/id/1039812","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","web"]},{"url":"https://security.gentoo.org/glsa/201711-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/sebastianbergmann/phpunit/pull/1956","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9841","tags":["advisory"]},{"url":"https://github.com/sebastianbergmann/phpunit/pull/1955","tags":["web"]},{"url":"https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml","tags":["web"]},{"url":"http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r7c9-c69m-rph8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9841","tags":["advisory"]},{"url":"https://github.com/sebastianbergmann/phpunit","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0429.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22038","tags":["report"]},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-9841","tags":["report"]},{"url":"http://phpunit.vulnbusters.com/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9841","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7171-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-9841","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:00:00Z","modified":"2025-10-21T23:55:39.301Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2022-1528","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:00:00Z","modified":"2025-10-21T23:55:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-02-15","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-r7c9-c69m-rph8","title":"Code Injection in PHPUnit","description":"Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `\u003c?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2022-03-26T00:19:30Z","modified":"2025-10-22T17:32:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2017-9841","title":"PHPUnit Command Injection Vulnerability","description":"PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","cwes":["CWE-94"],"kev":{"date_added":"2022-02-15","due_date":"2022-08-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2017-9841","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:29:00.177Z","modified":"2026-06-17T01:29:01.517Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-9841","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:29:00.177Z","modified":"2026-10-24T10:49:31.485073507Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2017-9841","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:29:00.177Z","modified":"2026-09-01T20:02:42.878123717Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"GHSA-r7c9-c69m-rph8","title":"Code Injection in PHPUnit","description":"Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `\u003c?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2022-03-26T00:19:30Z","modified":"2025-10-22T19:24:09.569632Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2017-9841","description":"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","status":"published","published":"2017-06-27T17:29:00Z","modified":"2026-02-04T03:51:49.142777Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"MGASA-2017-0429","title":"Updated mediawiki packages fix security vulnerabilities","description":"XSS when $wgShowExceptionDetails = false and browser sends non-standard\nurl escaping (CVE-2017-8808).\n\nReflected File Download from api.php (CVE-2017-8809).\n\nOn private wikis, login form shouldn't distinguish between login failure\ndue to bad username and bad password (CVE-2017-8810).\n\nIt's possible to mangle HTML via raw message parameter expansion\n(CVE-2017-8811).\n\nThe id attribute on headlines allow raw \u003e (CVE-2017-8812).\n\nLanguage converter can be tricked into replacing text inside tags by\nadding a lot of junk after the rule definition (CVE-2017-8814).\n\nLanguage converter: unsafe attribute injection via glossary rules\n(CVE-2017-8815).\n\ncomposer.json has require-dev versions of PHPUnit with known security\nissues (CVE-2017-9841).\n\nNote that MediaWiki 1.23.x on Mageia 5 is no longer supported.  Those\nusing the mediawiki package on Mageia 5 should upgrade to Mageia 6.\n","status":"published","published":"2017-11-29T18:52:42Z","modified":"2026-04-16T06:26:00.547690493Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"USN-7171-1","title":"phpunit vulnerability","description":"It was discovered that PHPUnit incorrectly handled web requests if exposed\nto the internet. An attacker could possibly use this issue to achive remote\ncode execution or obtain sensitive information.\n","status":"published","published":"2024-12-18T13:05:04Z","modified":"2026-06-25T13:32:29.81311579Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}