### [CVE-2017-9841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9841)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

### POC

#### Reference
- http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
- https://www.oracle.com/security-alerts/cpuoct2021.html

#### Github
- https://github.com/0day404/vulnerability-poc
- https://github.com/20142995/Goby
- https://github.com/20142995/nuclei-templates
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/ArrestX/--POC
- https://github.com/CLincat/vulcat
- https://github.com/Chocapikk/CVE-2017-9841
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/HimmelAward/Goby_POC
- https://github.com/Jhonsonwannaa/CVE-2017-9841-
- https://github.com/KayCHENvip/vulnerability-poc
- https://github.com/MadExploits/PHPunit-Exploit
- https://github.com/Mariam-kabu/cybersec-labs
- https://github.com/Miraitowa70/POC-Notes
- https://github.com/MrG3P5/CVE-2017-9841
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/RandomRobbieBF/phpunit-brute
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Sohrabian/special-cyber-security-topic
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Z0fhack/Goby_POC
- https://github.com/akr3ch/CVE-2017-9841
- https://github.com/cyberharsh/Php-unit-CVE-2017-9841
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/dial25sd/arf-vulnerable-vm
- https://github.com/incogbyte/laravel-phpunit-rce-masscaner
- https://github.com/jax7sec/CVE-2017-9841
- https://github.com/leoambrus/CheckersNomisec
- https://github.com/ludy-dev/PHPUnit_eval-stdin_RCE
- https://github.com/mSOC-io/webtraffic-reference
- https://github.com/mbrasile/CVE-2017-9841
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/merlinepedra25/nuclei-templates
- https://github.com/mileticluka1/eval-stdin
- https://github.com/p1ckzi/CVE-2017-9841
- https://github.com/rodnt/laravel-phpunit-rce-masscaner
- https://github.com/savior-only/javafx_tools
- https://github.com/shanyuhe/YesPoc
- https://github.com/silit77889/memek-loncat
- https://github.com/sobinge/nuclei-templates
- https://github.com/unp4ck/laravel-phpunit-rce-masscaner
- https://github.com/veo/vscan
- https://github.com/warriordog/little-log-scan
- https://github.com/yamori/pm2_logs
- https://github.com/yoloskr/CVE-2017-9841-Scan
- https://github.com/zapalm/prestashop-security-vulnerability-checker