GitHub Advisoryadvisory · Packagist

GHSA-r7c9-c69m-rph8 Code Injection in PHPUnit

CRITICAL Published 2022-03-26 Modified 2025-10-22 Official page ↗
Aliases
CVE-2017-9841
Ecosystem
Packagist
Packages
phpunit/phpunit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-94
Reviewed
2022-03-26

Affected packages

• Packagist phpunit/phpunit: >= 4.8.19, < 4.8.28 → fixed in 4.8.28 • Packagist phpunit/phpunit: >= 5.0.10, < 5.6.3 → fixed in 5.6.3

Description

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Related

Alias · CVE (1)

  • CVE-2017-9841 Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References