CVE-2025-34061 | BDVDB-2026-284580 Detail

Description#

A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-07-03Record published in the CVE List.
2. Version 22025-07-07Most recent update recorded in the CVE List.