$ cve CVE-2017-9841 JSON

CVE-2017-9841 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-08-15.

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	100% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-94
On CISA KEV	yes — remediate by 2022-08-15
Public exploit	yes
Published	2017-06-27
Last modified	2026-06-17

CISA KEV

Name	PHPUnit Command Injection Vulnerability
Added	2022-02-15
Due	2022-08-15
Vendor / product	PHPUnit / PHPUnit
Ransomware use	none reported

Affected (2)

Vendor	Product
oracle	communications diameter signaling router
phpunit project	phpunit

Public exploits

Source	Title	Date
exploit-db	PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)	2022-02-02

References

→ the Explorer · watch your stack · NVD