VYPR
Get started
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Jun 27, 2017· Updated Apr 21, 2026

CVE-2017-9841

CVE-2017-9841

Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpunit/phpunitPackagist
>= 4.8.19, < 4.8.284.8.28
phpunit/phpunitPackagist
>= 5.0.10, < 5.6.35.6.3

Affected products

2

Patches

4
284a69fb88a2

Correct fix for #1956

https://github.com/sebastianbergmann/phpunitBob WeinandNov 13, 2016via ghsa
commit
2 files changed · +2 −2
  • src/Util/PHP/eval-stdin.php+1 −1 modified
    @@ -1,3 +1,3 @@
 <?php
 
-eval('?>' . file_get_contents('php://input'));
+eval('?>' . file_get_contents('php://stdin'));
  • src/Util/PHP/Template/TestCaseMethod.tpl.dist+1 −1 modified
    @@ -55,7 +55,7 @@ function __phpunit_run_isolated_test()
         $output = $test->getActualOutput();
     }
 
-    rewind(STDOUT);
+    @rewind(STDOUT); /* @ as not every STDOUT target stream is rewindable */
     if ($stdout = stream_get_contents(STDOUT)) {
         $output = $stdout . $output;
     }
a9de0dbafeb6
https://github.com/sebastianbergmann/phpunitvia osv
3aaddb1c5bd9

Fix insulated tests with phpdbg

https://github.com/sebastianbergmann/phpunitNicolas GrekasNov 17, 2015via ghsa
commit
2 files changed · +9 −1
  • src/Util/PHP/Default.php+6 −1 modified
    @@ -30,9 +30,14 @@ class PHPUnit_Util_PHP_Default extends PHPUnit_Util_PHP
     public function runJob($job, array $settings = array())
     {
         $runtime = new Runtime;
+        $runtime = $runtime->getBinary() . $this->settingsToParameters($settings);
+
+        if ('phpdbg' === PHP_SAPI) {
+            $runtime .= ' -qrr '.escapeshellarg(__DIR__ . '/eval-stdin.php');
+        }
 
         $process = proc_open(
-            $runtime->getBinary() . $this->settingsToParameters($settings),
+            $runtime,
             array(
             0 => array('pipe', 'r'),
             1 => array('pipe', 'w'),
  • src/Util/PHP/eval-stdin.php+3 −0 added
    @@ -0,0 +1,3 @@
+<?php
+
+eval('?>'.file_get_contents('php://input'));
d3fbbc4d6f6f
https://github.com/sebastianbergmann/phpunitvia nvd-ref
PR #1956

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.