Search for vulnerabilities
Vulnerability details: VCID-4uyx-ns3w-gkdb
Vulnerability ID VCID-4uyx-ns3w-gkdb
Aliases CVE-2017-9841
GHSA-r7c9-c69m-rph8
Summary arbitrary code execution
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.94406 https://api.first.org/data/v1/epss?cve=CVE-2017-9841
epss 0.94406 https://api.first.org/data/v1/epss?cve=CVE-2017-9841
epss 0.94406 https://api.first.org/data/v1/epss?cve=CVE-2017-9841
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-r7c9-c69m-rph8
cvssv3.1 9.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
generic_textual CRITICAL https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
cvssv3.1 9.8 https://github.com/sebastianbergmann/phpunit
generic_textual CRITICAL https://github.com/sebastianbergmann/phpunit
cvssv3.1 9.8 https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
generic_textual CRITICAL https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
ssvc Act https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
cvssv3.1 9.8 https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
generic_textual CRITICAL https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
cvssv3.1 9.8 https://github.com/sebastianbergmann/phpunit/pull/1955
generic_textual CRITICAL https://github.com/sebastianbergmann/phpunit/pull/1955
cvssv3.1 9.8 https://github.com/sebastianbergmann/phpunit/pull/1956
generic_textual CRITICAL https://github.com/sebastianbergmann/phpunit/pull/1956
ssvc Act https://github.com/sebastianbergmann/phpunit/pull/1956
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-9841
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2017-9841
archlinux Critical https://security.archlinux.org/AVG-491
cvssv3.1 9.8 https://security.gentoo.org/glsa/201711-15
generic_textual CRITICAL https://security.gentoo.org/glsa/201711-15
ssvc Act https://security.gentoo.org/glsa/201711-15
cvssv3.1 9.8 https://www.oracle.com/security-alerts/cpuoct2021.html
generic_textual CRITICAL https://www.oracle.com/security-alerts/cpuoct2021.html
ssvc Act https://www.oracle.com/security-alerts/cpuoct2021.html
cvssv3.1 9.8 http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
generic_textual CRITICAL http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
cvssv3.1 9.8 http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
ssvc Act http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
cvssv3.1 9.8 http://www.securityfocus.com/bid/101798
generic_textual CRITICAL http://www.securityfocus.com/bid/101798
ssvc Act http://www.securityfocus.com/bid/101798
cvssv3.1 9.8 http://www.securitytracker.com/id/1039812
generic_textual CRITICAL http://www.securitytracker.com/id/1039812
ssvc Act http://www.securitytracker.com/id/1039812
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2017-9841
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9841
https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
https://github.com/sebastianbergmann/phpunit
https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
https://github.com/sebastianbergmann/phpunit/pull/1955
https://github.com/sebastianbergmann/phpunit/pull/1956
https://nvd.nist.gov/vuln/detail/CVE-2017-9841
https://security.gentoo.org/glsa/201711-15
https://www.oracle.com/security-alerts/cpuoct2021.html
http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
http://www.securityfocus.com/bid/101798
http://www.securitytracker.com/id/1039812
866200 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866200
AVG-491 https://security.archlinux.org/AVG-491
CVE-2017-9841 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/50702.py
GHSA-r7c9-c69m-rph8 https://github.com/advisories/GHSA-r7c9-c69m-rph8
phpunit.vulnbusters.com http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
USN-7171-1 https://usn.ubuntu.com/7171-1/
Data source Exploit-DB
Date added Feb. 2, 2022
Description PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
Ransomware campaign use Unknown
Source publication date Feb. 2, 2022
Exploit type webapps
Platform php
Source update date Feb. 2, 2022
Data source KEV
Date added Feb. 15, 2022
Description PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Required action Apply updates per vendor instructions.
Due date Aug. 15, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2017-9841
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sebastianbergmann/phpunit
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sebastianbergmann/phpunit/pull/1955
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sebastianbergmann/phpunit/pull/1956
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at https://github.com/sebastianbergmann/phpunit/pull/1956
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-9841
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/201711-15
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at https://security.gentoo.org/glsa/201711-15
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpuoct2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at https://www.oracle.com/security-alerts/cpuoct2021.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/101798
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at http://www.securityfocus.com/bid/101798
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securitytracker.com/id/1039812
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T14:09:44Z/ Found at http://www.securitytracker.com/id/1039812
Exploit Prediction Scoring System (EPSS)
Percentile 0.99971
EPSS Score 0.94406
Published At July 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T11:53:04.955437+00:00 Arch Linux Importer Import https://security.archlinux.org/AVG-491 36.1.3