cve/cves/2017/CVE-2017-9841.md

CVE-2017-9841

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

POC

Reference

• http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/

Github

• https://github.com/Chocapikk/CVE-2017-9841
• https://github.com/Jhonsonwannaa/CVE-2017-9841-
• https://github.com/MadExploits/PHPunit-Exploit
• https://github.com/Mariam-kabu/cybersec-labs
• https://github.com/MrG3P5/CVE-2017-9841
• https://github.com/akr3ch/CVE-2017-9841
• https://github.com/cyberharsh/Php-unit-CVE-2017-9841
• https://github.com/dream434/CVE-2017-9841
• https://github.com/dream434/CVE-2017-9841-
• https://github.com/jax7sec/CVE-2017-9841
• https://github.com/marvinoon/P1BG3-ExploitScan
• https://github.com/mbrasile/CVE-2017-9841
• https://github.com/mileticluka1/eval-stdin
• https://github.com/moonwayy/hindicybersec
• https://github.com/p1ckzi/CVE-2017-9841
• https://github.com/krisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC
• https://github.com/CheLover86/CVE-2017-9841
• https://github.com/lnlight05/Information-Security-Work1

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml

ExploitDB

• https://www.exploit-db.com/exploits/50702

Vulhub

• https://github.com/vulhub/vulhub/tree/master/phpunit/CVE-2017-9841

Collections

• https://github.com/chaitin/xray/blob/master/pocs/phpunit-cve-2017-9841-rce.yml
• https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2017/CVE-2017-9841.yaml