Security Research

CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point

#Vulnerability Analysis#Code Audit#Web Security#Developer Security
PHPUnit test file exposed as web RCE entry

PHPUnit is one of the most popular unit testing frameworks in the PHP ecosystem, but its eval-stdin.php file is designed as a tool to “accept PHP code via the CLI” — if this file is accidentally deployed to the production environment’s web directory, an attacker can execute arbitrary PHP code through a simple POST request, CVSS 9.8, no authentication required.

Unlock to view this content.