CVE-2017-9841
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
PHPUnit's eval-stdin.php script allows attackers to execute arbitrary PHP code by sending specially crafted HTTP POST requests. This is critical because it gives complete control over the server to anyone who can access the exposed file.
A remote code execution vulnerability in PHPUnit versions before 4.8.28 and 5.x before 5.6.3 exists in the eval-stdin.php utility script, which unsafely evaluates PHP code from POST data. An unauthenticated attacker can exploit this if the /vendor directory is publicly accessible, achieving arbitrary code execution on the server with the privileges of the web process.
The full analysis of this CVE is available in Portuguese →