PT-2025-27824 · Phpstudy · Phpstudy

Dimensional · Published 2025-07-03 · Updated 2025-07-04 · CVE-2025-34061

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: PHPStudy versions 2016 through 2018

Description: A backdoor in PHPStudy allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system.

Recommendations: For PHPStudy versions 2016 through 2018, consider disabling the acceptance of base64-encoded PHP payloads in the Accept-Charset HTTP header as a temporary workaround until a patch is available. Restrict access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-08218

CVE-2025-34061

Affected Products

Phpstudy

References · 11

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phpstudy_backdoor_rce.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34061 · Security Note
• https://bdu.fstec.ru/vul/2025-08218 · Security Note
• https://twitter.com/CCBalert/status/1941113230551581062 · Twitter Post
• https://twitter.com/CVEnew/status/1940876705503273289 · Twitter Post
• https://twitter.com/CveFindCom/status/1940866061101899811 · Twitter Post
• https://t.me/cvenotify/127658 · Telegram Post
• https://github.com/advisories/GHSA-2mv3-3vpm-p5pm · Note
• https://twitter.com/autumn_good_35/status/1941116662486597722 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940926793474547768 · Twitter Post
• https://xp.cn/phpstudy · Note