If you have ever seen an HTTP request in your server logs targeting /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php , you are witnessing an attempted exploit of . Despite being patched in 2016, this Remote Code Execution (RCE) remains one of the most frequently scanned vulnerabilities on the internet because it is simple to exploit and often left exposed in misconfigured production environments. What is the Exploit?
By sending an HTTP POST request with a body starting with the
Given the high volume of scanning for this exploit, monitoring is crucial:
The script lacks any authentication, access controls, or environment checks. If an attacker can reach this file via a web browser or automated HTTP client, they can execute arbitrary PHP code on the underlying hosting server with the permissions of the web server user (e.g., www-data ). Anatomy of the Attack Path vendor phpunit phpunit src util php eval-stdin.php exploit
Now, the attacker can simply visit https://target.com/shell.php?cmd=whoami and maintain access indefinitely, even after the original eval-stdin.php is removed.
PHPUnit is the undisputed standard for testing PHP applications, found in almost every modern project's vendor/ directory. However, a significant security flaw found in older versions—specifically the —has continued to plague developers years after its discovery.
If you manage PHP applications, it is highly recommended to scan your web directories for the existence of this file and ensure vendor access is blocked at the web server level. If you have ever seen an HTTP request
eval('?>' . file_get_contents('php://input'));
The attack vector for this vulnerability typically involves an attacker providing malicious input to the eval-stdin.php script. This can be achieved through various means, such as:
One of the most notable examples of this is , a severe Remote Code Execution (RCE) vulnerability found in PHPUnit, the standard testing framework for PHP. By sending an HTTP POST request with a
The vulnerability exists in the eval-stdin.php script, which was included in PHPUnit versions before 4.8.28 and 5.x before 5.6.3.
Protecting against the eval-stdin.php exploit requires a defense-in-depth approach. 1. Update PHPUnit
: Multiple modules historically included vulnerable copies of PHPUnit within their own directories.