# CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

- Page: https://www.vulneraibility.com/cve/CVE-2017-9841
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-02-15; CISA due date 2022-08-15
- EPSS: 100.00% (percentile 100.0)
- Public exploit code: 1 on Exploit-DB · 18 GitHub proofs of concept · 1 Nuclei template (first 2020-01-06)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-07)
- Weakness: CWE-94
- Published: 2017-06-27

## Affected

- phpunit_project:phpunit
- oracle:communications_diameter_signaling_router

## References

- [other] http://www.securityfocus.com/bid/101798
- [other] http://www.securitytracker.com/id/1039812
- [advisory] https://security.gentoo.org/glsa/201711-15
- [other] https://www.oracle.com/security-alerts/cpuoct2021.html
- [other] https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
- [other] https://github.com/sebastianbergmann/phpunit/pull/1956
- [other] http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.