CVE-2025-34061: PHPStudy Backdoor RCE Vulnerability

CVE-2025-34061 Overview

A critical backdoor vulnerability exists in PHPStudy versions 2016 through 2018 that allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system.

Critical Impact

Unauthenticated attackers can achieve full remote code execution by sending a specially crafted HTTP request with a malicious base64-encoded payload in the Accept-Charset header, potentially leading to complete system compromise.

Affected Products

• PHPStudy 2016
• PHPStudy 2017
• PHPStudy 2018

Discovery Timeline

• 2025-07-03 - CVE CVE-2025-34061 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-34061

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and represents an intentionally planted backdoor in PHPStudy installations. The backdoor mechanism is particularly insidious because it leverages a legitimate HTTP header field (Accept-Charset) to receive malicious payloads, making detection through traditional web application firewalls challenging.

The vulnerability requires no authentication and can be exploited remotely over the network. Since the malicious code executes with the privileges of the web server user, successful exploitation can lead to unauthorized access to sensitive data, lateral movement within the network, installation of additional malware, or use of the compromised system as a pivot point for further attacks.

Root Cause

The root cause of this vulnerability is an intentionally embedded backdoor within certain distributions of PHPStudy software. The backdoor code monitors incoming HTTP requests for the Accept-Charset header, and when present, attempts to decode the header value from base64 and execute it as PHP code. This represents a supply chain compromise where malicious functionality was deliberately inserted into the software.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by sending an HTTP request to any PHP page on the vulnerable server. The request must include an Accept-Charset header containing a base64-encoded PHP payload.

When the backdoored PHPStudy installation processes the request, it extracts the Accept-Charset header value, base64-decodes it, and passes the resulting string to PHP's eval() function or similar code execution mechanism. This allows the attacker to execute arbitrary PHP code in the context of the web server process.

A Metasploit module exists for this vulnerability, providing automated exploitation capabilities. For technical implementation details, refer to the Metasploit exploit module on GitHub.

Detection Methods for CVE-2025-34061

Indicators of Compromise

• Unusual HTTP requests containing base64-encoded strings in the Accept-Charset header
• Unexpected PHP process activity or spawned child processes from the web server
• Web server logs showing requests with abnormally long or suspicious Accept-Charset header values
• Evidence of webshell deployment or unauthorized file creation in web directories

Detection Strategies

• Implement web application firewall (WAF) rules to inspect and flag suspicious Accept-Charset header values containing base64-encoded content
• Deploy network intrusion detection signatures that match the pattern of PHPStudy backdoor exploitation attempts
• Use endpoint detection tools to monitor for PHP processes executing unusual system commands or establishing outbound connections
• Perform file integrity monitoring on PHPStudy installations to detect backdoored components

Monitoring Recommendations

• Enable detailed HTTP header logging on web servers to capture full request headers including Accept-Charset
• Monitor for base64 patterns in HTTP headers that decode to PHP code constructs
• Track process genealogy for web server processes to identify suspicious command execution
• Implement real-time alerting on web server processes creating new files or network connections

How to Mitigate CVE-2025-34061

Immediate Actions Required

• Immediately discontinue use of PHPStudy versions 2016 through 2018 in production environments
• Replace affected installations with alternative PHP development environments from trusted sources
• Conduct forensic analysis of any systems that were running vulnerable PHPStudy versions to identify potential compromise
• Review network logs for evidence of exploitation attempts targeting the Accept-Charset header

Patch Information

There is no official patch available for this vulnerability as the backdoor was intentionally embedded in the affected software distributions. The recommended remediation is to completely remove PHPStudy versions 2016-2018 and obtain PHP development tools from official, verified sources. Users can reference the official PHPStudy website for information about current software versions, though independent verification of software integrity is strongly recommended.

Workarounds

• Remove or replace the compromised PHPStudy installation entirely with a clean PHP environment built from official sources
• Block or filter HTTP requests containing suspicious patterns in the Accept-Charset header at the network perimeter
• If immediate removal is not possible, isolate affected systems from production networks and sensitive resources
• Implement strict web application firewall rules to drop requests with base64-encoded content in HTTP headers

# Example: Block suspicious Accept-Charset headers in Apache (mod_security rule)
SecRule REQUEST_HEADERS:Accept-Charset "@rx ^[A-Za-z0-9+/]{20,}={0,2}$" "id:1001,phase:1,deny,status:403,msg:'Potential PHPStudy backdoor exploitation attempt'"