The instance of Drupal running on the remote host is affected by a command execution vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to execute commands on the remote host.

PHPUnit is a testing framework for PHP built to perform unit tests in the application development cycle. PHPUnit versions before 4.8.28 and 5.x before 5.6.3 allow remote attackers to execute arbitrary PHP code via the /vendor/phpunit/src/Util/PHP/eval-stdin.php URI when exposed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute
    arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on
    a site with an exposed /vendor folder, i.e., external access to the
    /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. (CVE-2017-9841)

mediawiki reports :

security fixes :

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

T165846: BotPasswords doesn't throttle login attempts.

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

T176247: It's possible to mangle HTML via raw message parameter expansion.

T125163: id attribute on headlines allow raw.

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

T119158: Language converter: unsafe attribute injection via glossary rules.

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

The remote host is affected by the vulnerability described in GLSA-201711-15 (PHPUnit: Remote code execution)

    When PHPUnit is installed in a production environment via composer and       these modules are in a web accessible directory, the eval-stdin.php file       in PHPUnit contains vulnerable statements that trigger the vulnerability.
  Impact :

    A remote attacker could possibly execute arbitrary PHP code or cause a       Denial of Service condition.
  Workaround :

    There are several ways to fix or mitigate this vulnerability:
    Remove PHPUnit from the production environment.
    Update PHPUnit.
    Manually apply the patch.
    Disable direct access to the composer packages by placing .htaccess file       to /vendor folder.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7171-1 advisory.

    It was discovered that PHPUnit incorrectly handled web requests if exposed to the internet. An attacker     could possibly use this issue to achive remote code execution or obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
98704	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Web App Scanning	Component Vulnerability	9/19/2019	9/7/2021	critical
98984	PHPUnit Remote Code Execution	Web App Scanning	Component Vulnerability	3/11/2020	9/7/2021	critical
418561	SCA: security update for phpunit/phpunit (GHSA-r7c9-c69m-rph8)	Tenable Cloud Security	SCA Checks	1/23/2025	7/13/2026	critical
418561	SCA: security update for phpunit/phpunit (GHSA-r7c9-c69m-rph8)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/13/2026	critical
128551	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Nessus	CGI abuses	9/6/2019	7/29/2026	critical
104693	FreeBSD : mediawiki -- multiple vulnerabilities (298829e2-ccce-11e7-92e4-000c29649f92)	Nessus	FreeBSD Local Security Checks	11/20/2017	11/13/2025	critical
104696	GLSA-201711-15 : PHPUnit: Remote code execution	Nessus	Gentoo Local Security Checks	11/20/2017	11/13/2025	critical
213190	Ubuntu 16.04 LTS : PHPUnit vulnerability (USN-7171-1)	Nessus	Ubuntu Local Security Checks	12/18/2024	12/19/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical