.. / CVE-2017-9841

• RCE
• PoC
• Nuclei
• Web
• Hack The Box

Exploit for PHPUnit - Remote Code Execution (CVE-2017-9841)

Description:

PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a “<?php “ substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Nuclei Template

View the template here CVE-2017-9841.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-9841.yaml

Try the exploit in a lab environment:

References: