{
  "id": "phpunit-cve-2017-9841",
  "publication": "public",
  "reviewedAt": "2026-10-16",
  "type": "historical",
  "status": "detected",
  "package": "PHPUnit",
  "ecosystem": "Packagist",
  "title": {
    "zh": "測試輔助程式的程式碼注入",
    "en": "Code injection in a test helper"
  },
  "summary": {
    "zh": "部署在可由網路存取的位置時，舊版 eval-stdin.php 可能將 HTTP 請求內容當作 PHP 執行。",
    "en": "A web-accessible legacy eval-stdin.php can execute PHP supplied in an HTTP request body."
  },
  "cve": "CVE-2017-9841",
  "ghsa": "GHSA-r7c9-c69m-rph8",
  "cwe": "CWE-94",
  "sourceVersion": "5.6.2",
  "fixedVersion": "4.8.28 / 5.6.3",
  "sourceUrl": "https://github.com/sebastianbergmann/phpunit/blob/5.6.2/src/Util/PHP/eval-stdin.php",
  "advisoryUrl": "https://github.com/advisories/GHSA-r7c9-c69m-rph8",
  "fixUrl": "https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5",
  "publishedAt": "2017-06-27",
  "boundary": {
    "zh": "歷史聚焦掃描識別命中 eval-stdin.php:3，最終為 candidate。未在 web SAPI 執行，未驗證修補後的行為。",
    "en": "Historical focused scan matched eval-stdin.php:3 as a candidate. No web SAPI execution or fixed-version comparison was performed."
  },
  "method": {
    "zh": "將 5.6.2 的輔助程式交給聚焦 AI 審查，保留候選狀態與位置。下載紀錄附原報告雜湊。",
    "en": "Focused AI review of the 5.6.2 helper, retaining the candidate verdict and location. The record includes the original report digest."
  },
  "limitations": {
    "zh": "須有可由 HTTP 存取的測試工具檔案。這筆紀錄沒有端到端利用證據，也不代表 Vettalon 發現新漏洞。",
    "en": "Requires an HTTP-accessible test helper. This record contains no end-to-end exploit evidence and claims no new discovery."
  },
  "credit": {
    "zh": "已公開歷史漏洞；原始來源與分析者見公告。Vettalon 僅做識別測試。",
    "en": "Previously disclosed vulnerability; see the advisory for source and analyst attribution. Vettalon performed detection only."
  },
  "detection": {
    "mode": "focused",
    "findingStatus": "candidate",
    "file": "eval-stdin.php",
    "line": 3,
    "observedAt": "2026-10-12",
    "claim": {
      "zh": "eval-stdin.php:3 將 php://input 送入 eval；若檔案可由 HTTP 存取，請求內容可能被當成 PHP 執行。",
      "en": "eval-stdin.php:3 passes php://input to eval. HTTP accessibility could expose execution of request-supplied PHP."
    },
    "reviewerConclusion": {
      "zh": "codex：no_verdict。模型呼叫失敗，沒有完成有效覆核，最終保留 candidate。",
      "en": "codex: no_verdict. A model invocation failed; no valid review verdict was recorded, leaving a candidate."
    },
    "finder": "claude (Anthropic alias)",
    "reviewer": "codex (OpenAI alias): no_verdict",
    "toolVersion": "Not recorded in historical report (schema v2)",
    "modelVersions": "Exact model versions not recorded; aliases only",
    "scope": "Single file: eval-stdin.php; focused deep AI review; no truncation recorded",
    "rerun": "git clone --branch 5.6.2 --depth 1 https://github.com/sebastianbergmann/phpunit.git phpunit-case\nmkdir -p phpunit-focused\ncp phpunit-case/src/Util/PHP/eval-stdin.php phpunit-focused/\nvettalon scan ./phpunit-focused --profile deep --config ./config.toml --max-modules 8 --cross-check-top 8 --report ./phpunit-result.json --no-prior",
    "sha256": "0949c8ab616480fb25c5c781f03f98a0eb8262363239fda7a1f8db3f77131e7b"
  },
  "dossier": {
    "artifactPath": "/evidence/dossiers/phpunit-cve-2017-9841.json",
    "sha256": "05cf2431070873402b901cea2e0461be58cd2a133dc52dfce9769a1942189055",
    "runStatus": "incomplete",
    "incompleteReason": "units_failed"
  },
  "timeline": [
    {
      "date": "2017-06-27",
      "event": {
        "zh": "NVD 發布紀錄",
        "en": "NVD publication date"
      }
    },
    {
      "date": "2026-10-12",
      "event": {
        "zh": "聚焦識別測試，候選未確認",
        "en": "Focused detection; unconfirmed candidate"
      }
    },
    {
      "date": "2026-10-16",
      "event": {
        "zh": "公開來源與紀錄邊界核對",
        "en": "Public sources and evidence boundary reviewed"
      }
    }
  ]
}