CVE-2017-9841
PHPUnit Command Injection Vulnerability
- Published
- Jun 27, 2017
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Feb 2, 2022
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 12, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Sources
- PHPUnit - Remote Code ExecutionTemplate
http/cves/2017/CVE-2017-9841.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- Vulhub vulnerability labs
Declared conditions
- lab image version: vulhub/phpunit:5.6.2(phpunit/CVE-2017-9841/docker-compose.yml:services.web.image)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.