WaratekVRT Sign in

CVE-2017-9841 PHPUnit

Affected softwarePHPUnit
Severity9.8 Critical CVSS 3.1 3 scores
WeaknessCode injection (CWE-94)
Published27 Jun 2017
Updated17 Jun 2026

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-02-15 · remediation due 2022-08-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 66 citations · honeypot sightings · 17 exploits · earliest 2020-11-22.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 18 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2020-01-06.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-9841 in VulnCheck (free account), which lists 61 more citations and 12 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting SANS DShield sensors Exploitation attempts seen on 1 day 2024-05-04
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 1075 days 2023-11-13 to 2026-11-12
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 398 days 2025-10-05 to 2026-11-13
Reported exploitation imperva.com /blog/crimeops-of-the-kashmirblack-botnet-part-ii 2020-11-22
Reported exploitation blogs.juniper.net /en-us/threat-research/sysrv-botnet-expands-and-gains-persistence 2021-04-08
Reported exploitation unit42.paloaltonetworks.com /network-attack-trends-winter-2020 2021-04-12
Reported exploitation lacework.com /blog/sysrv-hello-expands-infrastructure 2021-04-22
Reported exploitation bleepingcomputer.com /news/security/new-cryptomining-malware-builds-an-army-of-windows-linux-bots 2021-04-24
Exploit reference VulnCheck XDB 7d5cdaa33e78 Exploit type: initial-access 2020-05-18
Exploit reference VulnCheck XDB 2f94822ef64a Exploit type: initial-access 2020-09-14
Exploit reference VulnCheck XDB 7d37988be1e1 Exploit type: initial-access 2021-01-27
Exploit reference VulnCheck XDB 7a39231796b7 Exploit type: initial-access 2021-07-04
Exploit reference VulnCheck XDB f2a50a4ad68f Exploit type: initial-access 2022-03-20

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Tool to try multiple paths for PHPunit RCE CVE-2017-9841 28 2020-05-18
Nuclei PHPUnit - Remote Code Execution
Exploit-DB PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) 2022-02-02
GitHub PoC Masscanner for Laravel phpunit RCE CVE-2017-9841 23 2021-07-04
GitHub PoC PHPUnit RCE 7 2023-08-27
GitHub PoC (CVE-2017-9841) PHPUnit_eval-stdin_php Remote Code Execution 6 2020-09-14
GitHub PoC PHPUnit CVE-2017-9841 Scanner in Go clean and fire. 5 2025-08-30
GitHub PoC PHPunit Checker CVE-2017-9841 By MrMad 5 2022-12-07
GitHub PoC A Tool for scanning CVE-2017-9841 with multithread 4 2023-03-13
GitHub PoC phpunit-shell | CVE_2017-9841 3 2022-04-09

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Communications / Signaling (PHP) (8.0.0.0-8.5.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Signaling (PHP) 8.0.0.0-8.5.0.0

Products and versions

2 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle communications diameter signaling router generic ≥ 8.0.0 and ≤ 8.5.0
nvd phpunit project phpunit generic ≤ 4.8.27 · ≥ 5.0.0 and ＜ 5.6.3

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, NO AUTH REMOTE EXPLOIT, SIGNALING (PHP) **Products:** ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER, ORACLE COMMUNICATIONS

References

URLTags
http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/ Third Party Advisory
http://www.securityfocus.com/bid/101798 Broken Link
http://www.securitytracker.com/id/1039812 Broken Link
https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5 Patch, Third Party Advisory
https://github.com/sebastianbergmann/phpunit/pull/1956 Patch, Third Party Advisory
https://security.gentoo.org/glsa/201711-15 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841 US Government Resource

Timeline
Published2017-06-27By the CVE Program.
VulnCheck KEV: earliest evidence2020-11-22Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-02-15Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-13Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.