@hoanghainh/komagu 2.4.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-16.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-16",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0035-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py line 12: cur.execute(\"SELECT * FROM orders WHERE id = %s\" % order_id)"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the unsanitized order_id directly into the SQL string. No ownership or role check is performed on this route; @login_required only ensures authentication, not authorization."
+    },
+    {
+      "finding_id": "INJ-I-0008-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs line 28: var list = db.Database.SqlQuery<Invoice>(\"SELECT * FROM Invoices WHERE Customer = '\" + customer + \"'\").ToList();"
+      ],
+      "control_found": null,
+      "notes": "The SQL string is built by concatenating the user-supplied customer value. No ownership or role guard is visible in the method; the controller is not decorated with [Authorize] in the provided context."
+    },
+    {
+      "finding_id": "INJ-I-0015-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/mapper/OrderMapper.xml line 9: ORDER BY ${orderBy}"
+      ],
+      "control_found": null,
+      "notes": "The ORDER BY clause interpolates the raw ${orderBy} value from the caller. No allow\u2011list or type cast is present in the snippet."
+    },
+    {
+      "finding_id": "INJ-I-0018-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java line 15: ResultSet rs = stmt.executeQuery(\"SELECT * FROM orders WHERE id = '\" + id + \"'\");"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the request parameter id directly into the SQL string. No ownership or role check is performed in the shown code."
+    },
+    {
+      "finding_id": "INJ-I-0019-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java line 17: sb.append(\" AND order_id = \").append(id);"
+      ],
+      "control_found": null,
+      "notes": "The string builder appends the unsanitized id into the SQL query. No ownership or role guard is visible in the snippet."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-17.json

@@ -0,0 +1,61 @@
+{
+  "batch_id": "verified-17",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0026-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php lines 9-11"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the raw $id parameter directly into the SQL string with no casting, escaping, or parameter binding. No ownership or role check is present in this method."
+    },
+    {
+      "finding_id": "INJ-I-0037-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "sql-procs/sp_search_orders.sql lines 4-6"
+      ],
+      "control_found": null,
+      "notes": "Dynamic SQL is built by concatenating @Customer and @Sort directly into the statement with no validation or allow\u2011list. The procedure executes the constructed string immediately."
+    },
+    {
+      "finding_id": "INJ-I-0038-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "sql-procs/sp_search_orders.sql lines 5-6"
+      ],
+      "control_found": null,
+      "notes": "The EXEC(@sql) call runs the user\u2011supplied dynamic SQL without any sanitization or parameterization."
+    },
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 1-11",
+        "classic-asp/shop/inc/auth.asp lines 1-3"
+      ],
+      "control_found": null,
+      "notes": "The included auth.asp only verifies that a session exists; it does not enforce any role. The delete statement is executed for any authenticated user."
+    },
+    {
+      "finding_id": "BFLA-R-0007-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 6-18"
+      ],
+      "control_found": null,
+      "notes": "The controller class is marked with [Authorize], which requires authentication but not an admin role. The DeleteUser action lacks a role check, allowing any authenticated user to delete arbitrary accounts."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-18.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-18",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 30-36"
+      ],
+      "control_found": null,
+      "notes": "The Export action returns all users when the query parameter isAdmin is true, and no [Authorize] or other role check is present in the visible code."
+    },
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/AdminUserController.java lines 13-16"
+      ],
+      "control_found": null,
+      "notes": "The delete method lacks any @PreAuthorize or other role guard in the visible code, allowing any authenticated user to delete any account."
+    },
+    {
+      "finding_id": "BFLA-R-0030-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/admin.js lines 8-9"
+      ],
+      "control_found": null,
+      "notes": "The route uses only ensureLoggedIn, which only checks authentication; no admin role check is present before the delete operation."
+    },
+    {
+      "finding_id": "BFLA-R-0032-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/admin.js lines 16-18"
+      ],
+      "control_found": null,
+      "notes": "The export route checks only the isAdmin query parameter and does not enforce an admin role guard in the visible code."
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php lines 6-8"
+      ],
+      "control_found": null,
+      "notes": "The view action performs a SELECT on users by id without any role check; the included auth.php only verifies login, not admin privileges."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-19.json

@@ -0,0 +1,65 @@
+{
+  "batch_id": "verified-19",
+  "verifications": [
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin.php lines 1-14",
+        "php-plain/inc/auth.php lines 1-7"
+      ],
+      "control_found": null,
+      "notes": "No role or ownership check is present in the visible code. The included auth file only verifies login."
+    },
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin/delete_user.php lines 1-8",
+        "php-plain/inc/auth.php lines 1-7"
+      ],
+      "control_found": null,
+      "notes": "The deletion is performed after casting the id, but no role check is shown. The auth file only checks authentication."
+    },
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/admin/promote.php lines 1-8",
+        "php-plain/inc/auth.php lines 1-7"
+      ],
+      "control_found": null,
+      "notes": "The role is set to 'admin' based on a request parameter with no preceding role verification. Auth file only ensures the user is logged in."
+    },
+    {
+      "finding_id": "BFLA-R-0059-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/manage_users.php lines 1-12",
+        "php-plain/inc/auth.php lines 1-7"
+      ],
+      "control_found": null,
+      "notes": "Deletion occurs on POST without a role check. The link is only shown to admins, but the server-side action is unprotected."
+    },
+    {
+      "finding_id": "BFLA-R-0063-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/profile.php lines 1-11",
+        "php-plain/inc/auth.php lines 1-7"
+      ],
+      "control_found": null,
+      "notes": "The code assigns the role from user input without any role verification. Auth file only checks authentication."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-2.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-2",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0006",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/order.cfm lines 1-10"
+      ],
+      "control_found": null,
+      "notes": "The code shows a query that selects an order by id without a user filter and outputs that result. No ownership or role check is present before the output. The second query that includes a user_id filter is not used. No compensating control is visible in the provided context."
+    },
+    {
+      "finding_id": "BOLA-R-0007",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 6-18"
+      ],
+      "control_found": null,
+      "notes": "The DeleteUser action is protected only by a generic [Authorize] attribute, allowing any authenticated user to delete any user. No role or ownership check is present in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0009",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/AdminController.cs lines 30-37"
+      ],
+      "control_found": null,
+      "notes": "The Export action checks a query string parameter for \"isAdmin\" but does not enforce an admin role or any ownership check. The control is not visible in the provided context."
+    },
+    {
+      "finding_id": "BOLA-R-0013",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 6-15"
+      ],
+      "control_found": null,
+      "notes": "The Details action retrieves an invoice by id without verifying that the invoice belongs to the current user. Only a generic [Authorize] attribute is present. No ownership check is visible."
+    },
+    {
+      "finding_id": "BOLA-R-0015",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 25-30"
+      ],
+      "control_found": null,
+      "notes": "The Search action performs a raw SQL query that returns all invoices for a given customer without filtering by the current user. No ownership or role check is present in the visible code."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-20.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-20",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0003-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 13-15"
+      ],
+      "control_found": null,
+      "notes": "The controller binds the entire Account object via @ModelAttribute and persists it without any visible ownership or role check in the provided code."
+    },
+    {
+      "finding_id": "MASS-M-0004-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java lines 25-28"
+      ],
+      "control_found": null,
+      "notes": "The update method accepts a full Account object via @RequestBody and saves it directly, with no ownership or role guard shown."
+    },
+    {
+      "finding_id": "MASS-M-0005-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/ProfileServlet.java lines 10-13"
+      ],
+      "control_found": null,
+      "notes": "BeanUtils.populate binds all request parameters to the Account object and the DAO persists it without any visible privilege check."
+    },
+    {
+      "finding_id": "MASS-M-0011-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/profile.php lines 6-8"
+      ],
+      "control_found": null,
+      "notes": "The code iterates over $_POST and assigns each field to the user object; no ownership or role validation is present in the visible snippet."
+    },
+    {
+      "finding_id": "MASS-M-0012-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-plain/profile.php line 10"
+      ],
+      "control_found": null,
+      "notes": "Explicit assignment of the role field from $_POST occurs without any guard; the snippet shows no ownership check."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-21.json

@@ -0,0 +1,62 @@
+{
+  "batch_id": "verified-21",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0001-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:12-15"
+      ],
+      "control_found": null,
+      "notes": "The Edit action accepts a full Customer model and persists it without any ownership or allow\u2011list checks. No role or ownership guard is visible in the provided code."
+    },
+    {
+      "finding_id": "MASS-M-0002-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs:27-31"
+      ],
+      "control_found": null,
+      "notes": "TryUpdateModel binds all request parameters to the Customer entity, and there is no visible ownership or allow\u2011list enforcement before saving."
+    },
+    {
+      "finding_id": "MASS-M-0008-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php:11-14",
+        "php-laravel/app/Models/User.php:6-9"
+      ],
+      "control_found": null,
+      "notes": "User::create($request->all()) uses a model with $guarded = [], allowing all attributes\u2014including 'role'\u2014to be mass\u2011assigned. No server\u2011side role assignment or guard is present."
+    },
+    {
+      "finding_id": "MASS-M-0009-1",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php:21-24",
+        "php-laravel/app/Models/Team.php:6-9"
+      ],
+      "control_found": null,
+      "notes": "Team::create($request->all()) allows 'owner_id' to be set via the request. No server\u2011side assignment of the current user\u2019s ID is performed."
+    },
+    {
+      "finding_id": "MASS-M-0006-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/profile.js:7-9"
+      ],
+      "control_found": null,
+      "notes": "User.findByIdAndUpdate(req.user._id, req.body, ...) updates the user document with the entire request body, exposing all fields to client manipulation. No allow\u2011list or role guard is visible."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-22.json

@@ -0,0 +1,50 @@
+{
+  "batch_id": "verified-22",
+  "verifications": [
+    {
+      "finding_id": "MASS-M-0007-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "node-express/routes/profile.js lines 7-9",
+        "node-express/routes/profile.js line 16"
+      ],
+      "control_found": null,
+      "notes": "The route updates the user document with the entire request body via `User.findByIdAndUpdate(req.user._id, req.body)`. No allow\u2011list, role, or ownership check is visible in the provided snippet. The code that might restrict fields (e.g., a Mongoose schema with `select: false` or a middleware that sanitizes `req.body`) is not shown, so the mass assignment remains unverified."
+    },
+    {
+      "finding_id": "MASS-M-0010-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 33-37"
+      ],
+      "control_found": null,
+      "notes": "The controller calls `$user->fill($request->all())->save()`, which performs whole\u2011object binding. Laravel protects against mass assignment via `$fillable` or `$guarded` properties on the model, but the model definition is not part of the provided context. Without visibility of those properties, the assignment cannot be confirmed safe."
+    },
+    {
+      "finding_id": "MASS-M-0015-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "python-flask/profile.py lines 24-30"
+      ],
+      "control_found": null,
+      "notes": "The PATCH route iterates over all keys in `request.json` and sets them on the user object. No allow\u2011list or ownership check is present in the snippet. The model\u2019s column restrictions or any request validation are not shown, so the mass assignment remains unverified."
+    },
+    {
+      "finding_id": "MASS-M-0014-verdict",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "python-flask/profile.py lines 8-13"
+      ],
+      "control_found": null,
+      "notes": "The POST `/users` route creates a new `User` by unpacking `request.json` directly into the model constructor (`User(**request.json)`). No field filtering or validation is visible in the snippet. The model\u2019s schema or any request\u2011validation middleware is not part of the provided context."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-3.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-3",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0017",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb"
+      ],
+      "control_found": null,
+      "notes": "The code_context shows a direct string concatenation of the order ID and note into an UPDATE statement with no visible ownership check, cast, or parameter binding. No role or ownership guard is present in the shown snippet."
+    },
+    {
+      "finding_id": "BOLA-R-0018",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs"
+      ],
+      "control_found": null,
+      "notes": "The unsafe SELECT query concatenates the order ID directly into the SQL and is executed. The subsequent safe query with user ID is defined but not used. No ownership check is visible in the executed path."
+    },
+    {
+      "finding_id": "BOLA-R-0019",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp"
+      ],
+      "control_found": null,
+      "notes": "The JSP concatenates the request parameter into a SELECT statement without any ownership filtering, cast, or parameter binding. No role or ownership guard is present in the snippet."
+    },
+    {
+      "finding_id": "BOLA-R-0020",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java"
+      ],
+      "control_found": null,
+      "notes": "The controller directly calls accountDao.save(account) without checking that the current user owns the account. No ownership or role check is visible in the snippet."
+    },
+    {
+      "finding_id": "BOLA-R-0021",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/AccountController.java"
+      ],
+      "control_found": null,
+      "notes": "The rename operation is performed on any account ID without verifying ownership. No ownership or role check is visible in the snippet."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-4.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-4",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0022",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "AccountController.update method in java-legacy/src/com/acme/web/AccountController.java"
+      ],
+      "control_found": null,
+      "notes": "The update method simply calls accountDao.save(account) with no visible ownership or role check. No global filter or middleware is shown in the provided context."
+    },
+    {
+      "finding_id": "BOLA-R-0023",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "AdminUserController.delete method in java-legacy/src/com/acme/web/AdminUserController.java"
+      ],
+      "control_found": null,
+      "notes": "The delete method invokes userDao.deleteById(id) without any role or ownership guard in the visible code. No other checks are shown."
+    },
+    {
+      "finding_id": "BOLA-R-0024",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "AdminUserController.delete method in java-legacy/src/com/acme/web/AdminUserController.java"
+      ],
+      "control_found": null,
+      "notes": "The method lacks an ownership check; only a role guard is present on the adjacent method. Therefore the missing ownership verification is confirmed."
+    },
+    {
+      "finding_id": "BOLA-R-0025",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "InvoiceController.show method in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "control_found": null,
+      "notes": "The show method retrieves an invoice by ID without any ownership filter. No role guard or other checks are visible in the context."
+    },
+    {
+      "finding_id": "BOLA-R-0027",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "InvoiceController.search method in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "control_found": null,
+      "notes": "The search method builds a query using the customer parameter directly, with no ownership or role guard shown."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-5.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-5",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0028",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "java-legacy/src/com/acme/web/OrderServlet.java lines 13-15"
+      ],
+      "control_found": null,
+      "notes": "The query selects the order by id without any user or tenant filter, and no ownership check is performed before the result is used."
+    },
+    {
+      "finding_id": "BOLA-R-0030",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/admin.js lines 8-9"
+      ],
+      "control_found": null,
+      "notes": "The delete route only requires authentication but does not enforce an admin role or check that the target user is not the current user."
+    },
+    {
+      "finding_id": "BOLA-R-0033",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js lines 8-9"
+      ],
+      "control_found": null,
+      "notes": "Order retrieval is performed solely by id with no filter on the current user, exposing all orders."
+    },
+    {
+      "finding_id": "BOLA-R-0043",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi lines 13-14"
+      ],
+      "control_found": null,
+      "notes": "The first query selects an order by id without a user filter; the subsequent query that includes user_id does not mitigate the vulnerability."
+    },
+    {
+      "finding_id": "BOLA-R-0044",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php lines 9-10"
+      ],
+      "control_found": null,
+      "notes": "The view method queries invoices by id only, without verifying that the invoice belongs to the current user."
+    }
+  ]
+}