CVE-2017-9841 Scanner

PHPUnit is a widely-used unit testing framework for PHP, employed by developers to automate testing of PHP code in development and CI/CD pipelines. It helps ensure code quality, detect regressions, and maintain application stability across various industries, from startups to large enterprises. As an open-source tool, PHPUnit is integral to modern PHP development workflows, often installed via Composer and included in project dependencies.

CVE-2017-9841 is a critical Remote Code Execution (RCE) vulnerability in PHPUnit versions prior to 5.7.21 and 6.1.6. It arises because the eval-stdin.php script, intended for internal testing, is accessible without authentication. The script accepts PHP code via HTTP POST data and executes it directly, allowing attackers to run arbitrary commands on the server.

The vulnerability specifically targets the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php endpoint. An attacker sends a POST request with PHP code in the body, which the script evaluates using the eval() function. This endpoint is often exposed when the /vendor directory is publicly accessible, a common misconfiguration in PHP projects.

If exploited, an attacker gains full remote control over the web server, enabling data theft, malware installation, site defacement, or lateral movement within the network. Given the CVSS score of 9.8, this vulnerability poses a severe risk to any PHP application using an affected PHPUnit version, potentially leading to complete compromise of the hosting environment.