Critical severity · published Jun 27, 2017
CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring,…
In wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 15, 2022
Federal remediation dueAug 15, 2022
Ransomware campaign useNot known
Affected products
Which versions
CD
Communications Diameter Signaling Router · Oracle
8.0.0 through 8.5.0 · source: NVD
PH
Phpunit · Phpunit Project
through 4.8.27; 5.0.0 before 5.6.3 · source: NVD, KEV
Affected product
CD
Communications Diameter Signaling Router
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9841
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Third Party Advisory
http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
Broken Link
http://www.securityfocus.com/bid/101798
Broken Link
http://www.securitytracker.com/id/1039812
Patch
https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
Patch
https://github.com/sebastianbergmann/phpunit/pull/1956
Third Party Advisory
https://security.gentoo.org/glsa/201711-15
More from Communications Diameter Signaling Router
9.8
CVE-2020-2555
Oracle Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-21783
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107
9.8
CVE-2020-11998
A regression has been introduced in the commit preventing JMX re-bind
9.8
CVE-2020-11973
Apache Camel Netty enables Java deserialization by default
9.8
CVE-2020-11972
Apache Camel RabbitMQ enables Java deserialization by default