EXPOSURES › CVE-2017-9841
CVE-2017-9841
HIGH ⌖ ON CISA KEV · EXPLOITEDPHPUnit's eval-stdin.php file allowed remote attackers to execute arbitrary PHP code via HTTP POST data when the /vendor folder was exposed.
A remote code execution vulnerability in PHPUnit allowed attackers to execute arbitrary PHP code by sending HTTP POST data starting with a '<?php' substring to an exposed /vendor folder. DIB organizations must ensure PHPUnit and all dependencies are patched and that /vendor folders are not publicly accessible to prevent similar exploits. This failure highlights the risk of relying on unpatched open-source components and the importance of strict access controls on exposed directories.
Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed remote code execution, indicating a severe and avoidable failure in securing a widely used testing framework.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.