@hoanghainh/komagu 2.4.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-partial/findings/inj-injection-001.json

@@ -0,0 +1,964 @@
+{
+  "batch_id": "injection-001",
+  "findings": [
+    {
+      "finding_id": "INJ-I-0001",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in member.asp via string concatenation",
+      "candidate_id": "I-0001",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 6,
+          "code": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+          "why": "User input concatenated into SQL"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 7,
+          "code": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+          "why": "User input concatenated into SQL"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 8,
+          "code": "conn.Execute sql",
+          "why": "Sink executes constructed query"
+        }
+      ],
+      "data_flow": [
+        "Request.Form (name)",
+        "$u",
+        "sql (member.asp:6-7)",
+        "conn.Execute (member.asp:8)"
+      ],
+      "attack_scenario": "A crafted name or member_id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0003",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in member.asp DELETE query",
+      "candidate_id": "I-0003",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 10,
+          "code": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString (member_id)",
+        "sql string",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted member_id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0004",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.asp.vb via string concatenation",
+      "candidate_id": "I-0004",
+      "location": {
+        "file": "classic-asp/shop/order.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 6,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "data_flow": [
+        "Request (id)",
+        "sql string",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0006",
+      "category": "sql_injection",
+      "subtype": "template_placeholder",
+      "title": "SQL Injection in OrderService.cfc via ColdFusion interpolation",
+      "candidate_id": "I-0006",
+      "location": {
+        "file": "coldfusion/app/OrderService.cfc",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "line": 5,
+          "code": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+          "why": "User input interpolated into SQL without cfqueryparam"
+        }
+      ],
+      "data_flow": [
+        "arguments.orderId",
+        "sql string",
+        "<cfquery>"
+      ],
+      "attack_scenario": "A crafted orderId changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use cfqueryparam or parameterized queries instead of string interpolation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0007",
+      "category": "sql_injection",
+      "subtype": "template_placeholder",
+      "title": "SQL Injection in order.cfm via ColdFusion interpolation",
+      "candidate_id": "I-0007",
+      "location": {
+        "file": "coldfusion/app/order.cfm",
+        "start_line": 3
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/order.cfm",
+          "line": 3,
+          "code": "SELECT * FROM orders WHERE id = #url.id#",
+          "why": "User input interpolated into SQL without cfqueryparam"
+        }
+      ],
+      "data_flow": [
+        "url.id",
+        "sql string",
+        "<cfquery>"
+      ],
+      "attack_scenario": "A crafted id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use cfqueryparam or parameterized queries instead of string interpolation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0009",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in OrderDetail.aspx.cs via string concatenation",
+      "candidate_id": "I-0009",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 7
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 10,
+          "code": "string id = Request.QueryString[\"id\"];",
+          "why": "source: QueryString"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "concatenated into SQL"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 15,
+          "code": "var r = cmd.ExecuteReader();",
+          "why": "sink"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString (id)",
+        "id",
+        "SqlCommand (OrderDetail.aspx.cs:13)",
+        "cmd.ExecuteReader"
+      ],
+      "attack_scenario": "A crafted id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0010",
+      "category": "sql_injection",
+      "subtype": "format_string",
+      "title": "SQL Injection in OrderDetail.aspx.cs via string.Format",
+      "candidate_id": "I-0010",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 19,
+          "code": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+          "why": "concatenated into SQL"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 21,
+          "code": "new SqlCommand(sql2, conn).ExecuteReader();",
+          "why": "sink"
+        }
+      ],
+      "data_flow": [
+        "Request (ref)",
+        "sql2",
+        "SqlCommand"
+      ],
+      "attack_scenario": "A crafted ref changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0011",
+      "category": "sql_injection",
+      "subtype": "string_interpolation",
+      "title": "SQL Injection in OrderDetail.aspx.cs via string interpolation",
+      "candidate_id": "I-0011",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 20,
+          "code": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+          "why": "concatenated into SQL"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 22,
+          "code": "new SqlCommand(sql3, conn).ExecuteNonQuery();",
+          "why": "sink"
+        }
+      ],
+      "data_flow": [
+        "Request.Form (cart)",
+        "sql3",
+        "SqlCommand"
+      ],
+      "attack_scenario": "A crafted cart changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0012",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in detail.jsp via string concatenation",
+      "candidate_id": "I-0012",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "line": 5,
+          "code": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "request.getParameter (no)",
+        "sql string",
+        "executeQuery"
+      ],
+      "attack_scenario": "A crafted no changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0016",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in EditUserAction.java via string concatenation",
+      "candidate_id": "I-0016",
+      "location": {
+        "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "line": 10,
+          "code": "String email = request.getParameter(\"email\");",
+          "why": "source: Request"
+        },
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "line": 13,
+          "code": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+          "why": "concatenated into SQL"
+        },
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "line": 14,
+          "code": "ps.executeUpdate();",
+          "why": "sink"
+        }
+      ],
+      "data_flow": [
+        "request.getParameter (email)",
+        "sql string",
+        "prepareStatement"
+      ],
+      "attack_scenario": "A crafted email changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0017",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "HQL Injection in InvoiceController.java via string concatenation",
+      "candidate_id": "I-0017",
+      "location": {
+        "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "line": 28,
+          "code": "public String search(@RequestParam(\"customer\") String customer, Model model) {",
+          "why": "source: Request"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "line": 29,
+          "code": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+          "why": "concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "@RequestParam (customer)",
+        "sql string",
+        "session.createQuery"
+      ],
+      "attack_scenario": "A crafted customer changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0020",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in orders.js via string concatenation",
+      "candidate_id": "I-0020",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 17
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 17,
+          "code": "db.query(\"SELECT * FROM reports WHERE month = '\" + req.query.month + \"'\", function (e, rows) { res.json(rows); });",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "req.query.month",
+        "sql string",
+        "db.query"
+      ],
+      "attack_scenario": "A crafted month changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0021",
+      "category": "sql_injection",
+      "subtype": "string_interpolation",
+      "title": "SQL Injection in orders.js via template literal interpolation",
+      "candidate_id": "I-0021",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 29,
+          "code": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+          "why": "User input interpolated into SQL"
+        }
+      ],
+      "data_flow": [
+        "req.query.shop",
+        "sql string",
+        "db.query"
+      ],
+      "attack_scenario": "A crafted shop changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0022",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in orders.js via direct object injection",
+      "candidate_id": "I-0022",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 21
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 21,
+          "code": "db.collection('users').findOne(req.body, function (e, u) { res.json(!!u); });",
+          "why": "User input passed directly as filter object"
+        }
+      ],
+      "data_flow": [
+        "req.body",
+        "filter object",
+        "findOne"
+      ],
+      "attack_scenario": "A crafted req.body injects malicious operators into the query.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0023",
+      "category": "nosql_injection",
+      "subtype": "string_concatenation",
+      "title": "NoSQL Injection in orders.js via $where string concatenation",
+      "candidate_id": "I-0023",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 25
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 25,
+          "code": "db.collection('items').find({ $where: \"this.name == '\" + req.query.n + \"'\" }).toArray(function (e, r) { res.json(r); });",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "req.query.n",
+        "$where string",
+        "find"
+      ],
+      "attack_scenario": "A crafted n changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0024",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.cgi via string concatenation",
+      "candidate_id": "I-0024",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 11,
+          "code": "my $id = $q->param('id');",
+          "why": "source: Request"
+        },
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 13,
+          "code": "my $sth = $dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+          "why": "concatenated into SQL"
+        },
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 14,
+          "code": "$sth->execute();",
+          "why": "sink"
+        }
+      ],
+      "data_flow": [
+        "$q->param (id)",
+        "$id",
+        "prepare"
+      ],
+      "attack_scenario": "A crafted id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0025",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.cgi via string concatenation",
+      "candidate_id": "I-0025",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 19,
+          "code": "$dbh->do(\"DELETE FROM carts WHERE cart_id = \" . $q->param('cart'));",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "$q->param (cart)",
+        "sql string",
+        "do"
+      ],
+      "attack_scenario": "A crafted cart changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0028",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in admin.php via string concatenation",
+      "candidate_id": "I-0028",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 11,
+          "code": "$id = $_POST['id'];",
+          "why": "source: POST body"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "$_POST['id']",
+        "$id",
+        "mysql_query"
+      ],
+      "attack_scenario": "A crafted id changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0029",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in mongo_find.php via direct object injection",
+      "candidate_id": "I-0029",
+      "location": {
+        "file": "php-plain/mongo_find.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 5,
+          "code": "$doc = $coll->findOne(array('login' => $_GET['login'], 'pass' => $_GET['pass']));",
+          "why": "User input passed directly as filter object"
+        }
+      ],
+      "data_flow": [
+        "$_GET['login']",
+        "filter object",
+        "findOne"
+      ],
+      "attack_scenario": "A crafted login changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0030",
+      "category": "nosql_injection",
+      "subtype": "string_concatenation",
+      "title": "NoSQL Injection in mongo_find.php via $where string concatenation",
+      "candidate_id": "I-0030",
+      "location": {
+        "file": "php-plain/mongo_find.php",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 6,
+          "code": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+          "why": "User input concatenated into SQL"
+        }
+      ],
+      "data_flow": [
+        "$_GET['n']",
+        "$where string",
+        "find"
+      ],
+      "attack_scenario": "A crafted n changes the WHERE clause and bypasses the password check.",
+      "impact": "Authentication bypass; read/modify any table the DB user can access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or prepared statements instead of string concatenation.",
+      "status": "unverified"
+    }
+  ],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "I-0001",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0001"
+      ]
+    },
+    {
+      "candidate_id": "I-0002",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0001"
+      ]
+    },
+    {
+      "candidate_id": "I-0003",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0003"
+      ]
+    },
+    {
+      "candidate_id": "I-0004",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0004"
+      ]
+    },
+    {
+      "candidate_id": "I-0005",
+      "verdict": "safe",
+      "reason": "Strict type cast (CLng) prevents SQL injection syntax manipulation."
+    },
+    {
+      "candidate_id": "I-0006",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0006"
+      ]
+    },
+    {
+      "candidate_id": "I-0007",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0007"
+      ]
+    },
+    {
+      "candidate_id": "I-0009",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0009"
+      ]
+    },
+    {
+      "candidate_id": "I-0010",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0010"
+      ]
+    },
+    {
+      "candidate_id": "I-0011",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0011"
+      ]
+    },
+    {
+      "candidate_id": "I-0012",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0012"
+      ]
+    },
+    {
+      "candidate_id": "I-0014",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0012"
+      ]
+    },
+    {
+      "candidate_id": "I-0016",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0016"
+      ]
+    },
+    {
+      "candidate_id": "I-0017",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0017"
+      ]
+    },
+    {
+      "candidate_id": "I-0020",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0020"
+      ]
+    },
+    {
+      "candidate_id": "I-0021",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0021"
+      ]
+    },
+    {
+      "candidate_id": "I-0022",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0022"
+      ]
+    },
+    {
+      "candidate_id": "I-0023",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0023"
+      ]
+    },
+    {
+      "candidate_id": "I-0024",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0024"
+      ]
+    },
+    {
+      "candidate_id": "I-0025",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0025"
+      ]
+    },
+    {
+      "candidate_id": "I-0027",
+      "verdict": "safe",
+      "reason": "Strict type cast ((int)) prevents SQL injection syntax manipulation."
+    },
+    {
+      "candidate_id": "I-0028",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0028"
+      ]
+    },
+    {
+      "candidate_id": "I-0029",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0029"
+      ]
+    },
+    {
+      "candidate_id": "I-0030",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "INJ-I-0030"
+      ]
+    }
+  ]
+}