Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade phpunit | Jul 30, 2024 | Jun 27, 2017 |
| Freebsd | — | Upgrade mediawiki127Upgrade mediawiki128Upgrade mediawiki129 | Nov 19, 2017 | Nov 19, 2017 |
| Gentoo Linux | — | Upgrade dev-php/phpunit. | Nov 20, 2017 | Jun 27, 2017 |
| Moodle | — | Upgrade to the latest version of Moodle | Sep 19, 2017 | Jun 27, 2017 |
| Ubuntu | — | Upgrade phpunit (Ubuntu Pro) | Dec 19, 2024 | Jun 27, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub