Vulnerability · Published Jul 3, 2025 · Assigned by VulnCheck
CVE-2025-34061PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability
Critical 9.3
In plain English
A critical-severity code injection in PHPStudy from Henan Xiaopi Security Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Henan Xiaopi Security Technology Co., Ltd. | PHPStudy | 2016 – through 2018 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N