Description
PHPUnit is a programmer-oriented testing framework for PHP. PHPUnit 4.x versions before 4.8.28 and 5.x versions before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring. This vulnerability is exploitable only if the /vendor folder is publicly accessible.
Remediation
Upgrade to the latest version of PHPUnit. This issue was fixed in PHPUnit versions 4.8.28 and 5.6.3.
References
Related Vulnerabilities
Oracle WebLogic Remote Code Execution (CVE-2020-14882)
Authentication bypass via MongoDB operator injection
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
Apache Solr SSRF CVE-2017-3164
WordPress 'wp-admin/options.php' Remote Code Execution Vulnerability (0.6.2 - 2.3.2)