Code Injection in PHPUnit - CVE-2017-9841

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Util/PHP/eval-stdin.php. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2017-9841

Links to Public Exploits and PoC-codes

• Exploit #11838 - Argus ("Argus" is a security tool designed to scan a list of websites for a known vulnerability in the PHPUnit framework, specifically the CVE-2017-9841 vulnerability. The tool attempts to exploit this vulnerability to verify its existence.) (August 8, 2025)
• Exploit #9507 - PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) (January 17, 2024)

External References

• https://github.com/sebastianbergmann/phpunit/pull/1956
• https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
• http://www.securityfocus.com/bid/101798
• http://www.securitytracker.com/id/1039812
• https://security.gentoo.org/glsa/201711-15
• http://web.archive.org/web/20170701212357/
• http://phpunit.vulnbusters.com/
• https://www.oracle.com/security-alerts/cpuoct2021.html

Related Security Bulletins

• Remote code execution in PHPUnit
• Ubuntu update for phpunit
• Gentoo update for PHPUnit