漏洞描述
PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/cyberharsh/Php-unit-CVE-2017-9841↗github.comhttps://github.com/RandomRobbieBF/phpunit-brute↗thephp.cchttps://thephp.cc/articles/phpunit-a-security-risk↗twitter.comhttps://twitter.com/sec715/status/1411517028012158976↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2017-9841↗