ZeroDay Findings
Sign inSign up

Findings

CVE-2017-9841

PHPUnit Command Injection Vulnerability

Published Jun 27, 2017 · updated Jun 16, 2026 · phpunit project phpunit

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 27, 2017 · Catalog

    Detected

    Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

  2. Feb 15, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Aug 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Required action

Apply updates per vendor instructions.

CISA due date Aug 15, 2022

Affected

  • cpe oracle/communications diameter signaling routerversion unspecified
  • cpe phpunit project/phpunitversion unspecified
  • vendor PHPUnit PHPUnitversion unspecified

Sources

  • CISA KEVCVE-2017-9841

    PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

    cisa.gov
  • CVE.orgCVE-2017-9841

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-9841

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database50702

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2017-9841

    Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the

    nvd.nist.gov

References