{
  "schemaVersion": 1,
  "caseId": "phpunit-cve-2017-9841",
  "originalReport": {
    "sha256": "0949c8ab616480fb25c5c781f03f98a0eb8262363239fda7a1f8db3f77131e7b",
    "schemaVersion": 2
  },
  "scan": {
    "runStatus": "incomplete",
    "incompleteReason": "units_failed"
  },
  "finding": {
    "file": "eval-stdin.php",
    "line": 3,
    "status": "candidate",
    "title": "Unauthenticated remote code execution via eval of raw HTTP request body (CVE-2017-9841 pattern)",
    "snippet": "<?php\n\neval('?>' . file_get_contents('php://input'));",
    "reportedFileSha256": "64589452b166cb815b3f7ab28324bd743fc606e7a3a8ca207d2faa313e5d4cf3"
  },
  "review": {
    "model": "codex",
    "family": "openai",
    "verdict": "no_verdict",
    "detail": null,
    "omissionReason": "runtime_error_trace_excluded"
  },
  "publicSource": {
    "url": "https://github.com/sebastianbergmann/phpunit/blob/5.6.2/src/Util/PHP/eval-stdin.php#L3",
    "commit": null,
    "sourceBytesVerified": false
  },
  "limitations": {
    "zh": "僅節錄此已公開歷史漏洞對應 finding 與有效覆核原文；原始報告不公開，未納入其他候選、環境或錯誤堆疊。模型文字是當時的分析主張，不是利用成功或人工確認。reportedFileSha256 僅為原報告所記雜湊，未重新核對歷史來源位元組；tag 行號連結只是公開參考，commit 未知。此人工選編與兩種 SHA-256 都不是簽章或可信執行證明。",
    "en": "Only the finding for this disclosed historical vulnerability and any valid review text are excerpted verbatim. The original report is not public; other findings, environment data and error traces are excluded. Model text is a historical analysis claim, not successful exploitation or human confirmation. reportedFileSha256 is copied from the report; historical source bytes were not independently rechecked. The tag and line URL is a public reference only; the commit is unknown. Curation and either SHA-256 are not signatures or trusted execution proof."
  }
}