CVE-2017-9841: PHPUnit - Remote Code Execution
HoneyLabs honeypots recorded 2,426 probes matching CVE-2017-9841 from 50 distinct source IP addresses in the last 7 days. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list.
Request paths that identify it
- /lib/phpunit/Util/PHP/eval-stdin.php
- /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
- /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
- /lib/phpunit/phpunit/Util/PHP/eval-stdin.php
- /phpunit/phpunit/src/Util/PHP/eval-stdin.php
- /phpunit/Util/PHP/eval-stdin.php
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 31.132.90.3 | 216 | Kar-Tel LLC | Kazakhstan |
| 95.173.161.147 | 144 | Netinternet Bilisim Teknolojileri AS | Türkiye |
| 138.2.102.66 | 144 | Oracle Corporation | Singapore |
| 171.244.14.216 | 108 | CHT Compamy Ltd | Vietnam |
| 223.123.92.77 | 108 | CMPak Limited | Pakistan |
| 212.47.66.218 | 72 | Contabo GmbH | France |
| 87.192.253.110 | 72 | Uzbektelekom Joint Stock Company | Uzbekistan |
| 103.46.186.148 | 72 | PT Air Lintas Komunikasi | Indonesia |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS197556 | Kar-Tel LLC | 216 | 1 |
| AS51167 | Contabo GmbH | 180 | 4 |
| AS31898 | Oracle Corporation | 144 | 1 |
| AS51559 | Netinternet Bilisim Teknolojileri AS | 144 | 1 |
| AS59257 | CMPak Limited | 144 | 2 |
| AS38731 | CHT Compamy Ltd | 108 | 1 |
Captured requests
- /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
- /vendor/phpunit/src/Util/PHP/eval-stdin.php
- /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
- /phpunit/phpunit/src/Util/PHP/eval-stdin.php
HTTP client fingerprints (JA4H)
- ge11nn0700_3161ce9d7233
- ge11nn0700_c5a94e7539c9
- ge11nn0600_285c7a41a4af
- ge11nn0700_7d7c303481e6
CVE report
CVE report
Open a specific CVE from the CVE tracker.