CriticalPublic exploit

PHPStudy 2016-2018 Backdoor Remote Code Execution

IdentifiersCVE-2025-34061CWE-912

CVE-2025-34061 is a backdoor-based remote code execution vulnerability affecting PHPStudy versions 2016 through 2018. The implanted backdoor inspects incoming HTTP requests for a base64-encoded PHP payload supplied in the Accept-Charset header, decodes that payload, and executes it without authentication or validation. Because the malicious logic is intentionally embedded as a backdoor rather than arising from ordinary input-handling flaws, exploitation allows arbitrary PHP code execution within the context of the affected PHPStudy web environment.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary PHP code on the affected system as the web server user. This can result in full compromise of the hosted web application environment, including theft or modification of application data, deployment of webshells or additional malware, use of the host for pivoting or persistence, and potentially broader system compromise depending on the privileges of the web server account and local configuration.

Mitigation

If you can’t patch tonight, do this now.

As an immediate mitigation, restrict external access to affected PHPStudy instances, especially any Internet-exposed deployments. Monitor and filter inbound requests containing suspicious Accept-Charset headers with base64-like content, and use a WAF or reverse proxy to block such requests where feasible. Review web server logs and file integrity for signs of exploitation, isolate suspected compromised hosts, and limit the privileges of the web server account to reduce post-exploitation impact. These measures are compensating controls only; removal of the backdoored version is the proper fix.

Remediation

Patch, then assume compromise.

Upgrade or replace affected PHPStudy installations from the 2016 through 2018 versions with a clean, trusted release that does not contain the backdoor. Verify the integrity and provenance of the PHPStudy package and all deployed application files, remove any unauthorized modifications or webshells, rotate credentials that may have been exposed, and perform incident response to determine whether exploitation occurred. If the software was obtained from an untrusted source, redeploy from known-good media and review the host for post-compromise artifacts.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

phpstudy_backdoor_rce.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/multi/http/phpstudy_backdoor_rce.rb) that exploits a backdoor in PHPStudy (versions 2016-2018), as referenced by CVE-2025-34061. The module leverages the Metasploit framework and is written in Ruby. It targets web servers running the vulnerable PHPStudy backdoor, typically accessible at /l.php or /index.php. The exploit works by sending a specially crafted HTTP GET request with a base64-encoded PHP payload in the Accept-Charset header, which the backdoor executes, resulting in remote code execution. The module includes both detection (via the check method) and exploitation capabilities, and allows for customizable payloads using Metasploit's payload system. The structure is standard for Metasploit modules, with clear separation of initialization, detection, and exploitation logic.

Disclosed Sep 20, 2019rubynetwork

ACTIVITY FEED

Recent activity

5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

5 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5