2020-08-07 08:02:28 +00:00
id : CVE-2017-9841
info :
name : CVE-2017-9841
author : Random-Robbie
2020-08-31 18:34:29 +00:00
severity : high
2020-08-25 21:51:04 +00:00
description : Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
2020-08-07 08:13:01 +00:00
# Reference to exploit
2020-08-07 08:11:39 +00:00
# https://github.com/cyberharsh/Php-unit-CVE-2017-9841
# https://github.com/RandomRobbieBF/phpunit-brute
2020-08-07 08:02:28 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
- "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
matchers-condition : and
matchers :
- type : word
words :
- "this version of phpunit requires php 5"
part : body
- type : status
status :
- 200
