@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/inj-injection-001.json

@@ -0,0 +1,1123 @@
+{
+  "batch_id": "injection-001",
+  "findings": [
+    {
+      "finding_id": "INJ-I-0001",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in member.asp:6 via Request.Form concatenation",
+      "candidate_id": "I-0001",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 6,
+          "code": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 7,
+          "code": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 8,
+          "code": "conn.Execute sql",
+          "why": "Sink executes constructed query"
+        }
+      ],
+      "data_flow": [
+        "Request.Form(name)",
+        "Request.Form(member_id)",
+        "sql variable",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted name or member_id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Modification of user data; potential for arbitrary updates if WHERE clause is manipulated.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0002",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in member.asp:7 via Request.Form concatenation",
+      "candidate_id": "I-0002",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 7
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 6,
+          "code": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 7,
+          "code": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 8,
+          "code": "conn.Execute sql",
+          "why": "Sink executes constructed query"
+        }
+      ],
+      "data_flow": [
+        "Request.Form(name)",
+        "Request.Form(member_id)",
+        "sql variable",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted name or member_id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Modification of user data; potential for arbitrary updates if WHERE clause is manipulated.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0003",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in member.asp:10 via Request.QueryString concatenation",
+      "candidate_id": "I-0003",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 10,
+          "code": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 8,
+          "code": "conn.Execute sql",
+          "why": "Previous query execution (contextual sink for the block)"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString(member_id)",
+        "SQL string literal",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted member_id parameter can alter the SQL logic, potentially deleting unintended records.",
+      "impact": "Deletion of database records; potential for arbitrary data loss.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0004",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.asp:6 via Request concatenation",
+      "candidate_id": "I-0004",
+      "location": {
+        "file": "classic-asp/shop/order.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 5,
+          "code": "id = Request(\"id\")",
+          "why": "User input source"
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 6,
+          "code": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 12,
+          "code": "Set rs2 = conn.Execute(\"SELECT * FROM orders WHERE id = \" & sid & \" AND user_id = \" & CLng(Session(\"UserID\")))",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "Request(id)",
+        "sid (derived from Request)",
+        "SQL string literal",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted id or sid parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0005",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.asp:12 via Request concatenation",
+      "candidate_id": "I-0005",
+      "location": {
+        "file": "classic-asp/shop/order.asp",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 5,
+          "code": "id = Request(\"id\")",
+          "why": "User input source"
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 6,
+          "code": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "line": 12,
+          "code": "Set rs2 = conn.Execute(\"SELECT * FROM orders WHERE id = \" & sid & \" AND user_id = \" & CLng(Session(\"UserID\")))",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "Request(id)",
+        "sid (derived from Request)",
+        "SQL string literal",
+        "conn.Execute"
+      ],
+      "attack_scenario": "A crafted id or sid parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0006",
+      "category": "sql_injection",
+      "subtype": "template_placeholder",
+      "title": "SQL Injection in OrderService.cfc:5 via ColdFusion template interpolation",
+      "candidate_id": "I-0006",
+      "location": {
+        "file": "coldfusion/app/OrderService.cfc",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "line": 3,
+          "code": "<cfargument name=\"orderId\" type=\"string\" required=\"true\">",
+          "why": "Argument source"
+        },
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "line": 5,
+          "code": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+          "why": "ColdFusion template interpolation without cfqueryparam"
+        }
+      ],
+      "data_flow": [
+        "arguments.orderId (function argument)",
+        "SQL string literal",
+        "cfquery"
+      ],
+      "attack_scenario": "A crafted orderId parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use cfqueryparam to type-cast the argument or use a stored procedure.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0007",
+      "category": "sql_injection",
+      "subtype": "template_placeholder",
+      "title": "SQL Injection in order.cfm:3 via ColdFusion template interpolation",
+      "candidate_id": "I-0007",
+      "location": {
+        "file": "coldfusion/app/order.cfm",
+        "start_line": 3
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/order.cfm",
+          "line": 2,
+          "code": "<cfquery name=\"qOrder\" datasource=\"shop\">",
+          "why": "Query sink"
+        },
+        {
+          "file": "coldfusion/app/order.cfm",
+          "line": 3,
+          "code": "SELECT * FROM orders WHERE id = #url.id#",
+          "why": "ColdFusion template interpolation without cfqueryparam"
+        }
+      ],
+      "data_flow": [
+        "url.id (request input)",
+        "SQL string literal",
+        "cfquery"
+      ],
+      "attack_scenario": "A crafted id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use cfqueryparam to type-cast the value or use a stored procedure.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0009",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in OrderDetail.aspx.cs:13 via string concatenation",
+      "candidate_id": "I-0009",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 7
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 10,
+          "code": "string id = Request.QueryString[\"id\"];",
+          "why": "User input source"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 19,
+          "code": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 20,
+          "code": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+          "why": "User input interpolated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString(id)",
+        "Request(ref)",
+        "Request.Form(cart)",
+        "SQL string literals",
+        "SqlCommand"
+      ],
+      "attack_scenario": "A crafted id, ref, or cart parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify/Delete of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0010",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in OrderDetail.aspx.cs:19 via string.Format concatenation",
+      "candidate_id": "I-0010",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 10,
+          "code": "string id = Request.QueryString[\"id\"];",
+          "why": "User input source"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 19,
+          "code": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 20,
+          "code": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+          "why": "User input interpolated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString(id)",
+        "Request(ref)",
+        "Request.Form(cart)",
+        "SQL string literals",
+        "SqlCommand"
+      ],
+      "attack_scenario": "A crafted id, ref, or cart parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify/Delete of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0011",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in OrderDetail.aspx.cs:20 via interpolated string concatenation",
+      "candidate_id": "I-0011",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 10,
+          "code": "string id = Request.QueryString[\"id\"];",
+          "why": "User input source"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 19,
+          "code": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "line": 20,
+          "code": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+          "why": "User input interpolated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "Request.QueryString(id)",
+        "Request(ref)",
+        "Request.Form(cart)",
+        "SQL string literals",
+        "SqlCommand"
+      ],
+      "attack_scenario": "A crafted id, ref, or cart parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify/Delete of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0012",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in detail.jsp:5 via string concatenation",
+      "candidate_id": "I-0012",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "line": 3,
+          "code": "String no = request.getParameter(\"no\");",
+          "why": "User input source"
+        },
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "line": 5,
+          "code": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "request.getParameter(no)",
+        "SQL string literal",
+        "executeQuery"
+      ],
+      "attack_scenario": "A crafted no parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use PreparedStatement with bound parameters instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0016",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in EditUserAction.java:13 via string concatenation",
+      "candidate_id": "I-0016",
+      "location": {
+        "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "line": 10,
+          "code": "String userId = request.getParameter(\"user_id\");",
+          "why": "User input source"
+        },
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "line": 13,
+          "code": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "request.getParameter(user_id)",
+        "SQL string literal",
+        "prepareStatement"
+      ],
+      "attack_scenario": "A crafted user_id or email parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Modification of user data; potential for arbitrary updates if WHERE clause is manipulated.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use PreparedStatement with bound parameters instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0017",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in InvoiceController.java:29 via string concatenation",
+      "candidate_id": "I-0017",
+      "location": {
+        "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "line": 28,
+          "code": "public String search(@RequestParam(\"customer\") String customer, Model model) {",
+          "why": "User input source"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "line": 29,
+          "code": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "@RequestParam(customer)",
+        "SQL string literal",
+        "session.createQuery"
+      ],
+      "attack_scenario": "A crafted customer parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0020",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in orders.js:17 via string concatenation",
+      "candidate_id": "I-0020",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 17
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 16,
+          "code": "db.query(\"SELECT * FROM reports WHERE month = '\" + req.query.month + \"'\", function (e, rows) { res.json(rows); });",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "req.query.month",
+        "SQL string literal",
+        "db.query"
+      ],
+      "attack_scenario": "A crafted month parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0021",
+      "category": "sql_injection",
+      "subtype": "string_interpolation",
+      "title": "SQL Injection in orders.js:29 via template literal interpolation",
+      "candidate_id": "I-0021",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 28,
+          "code": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+          "why": "User input interpolated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "req.query.shop",
+        "SQL string literal",
+        "db.query"
+      ],
+      "attack_scenario": "A crafted shop parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string interpolation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0022",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in orders.js:21 via direct request body usage",
+      "candidate_id": "I-0022",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 21
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 20,
+          "code": "db.collection('users').findOne(req.body, function (e, u) { res.json(!!u); });",
+          "why": "User input passed directly as filter object"
+        }
+      ],
+      "data_flow": [
+        "req.body",
+        "filter object",
+        "findOne"
+      ],
+      "attack_scenario": "A crafted req.body can inject operators like $ne or $gt to bypass filters or modify data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Validate and sanitize the request body against a strict schema before passing to the database.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0023",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in orders.js:25 via $where with string concatenation",
+      "candidate_id": "I-0023",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 25
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 24,
+          "code": "db.collection('items').find({ $where: \"this.name == '\" + req.query.n + \"'\" }).toArray(function (e, r) { res.json(r); });",
+          "why": "User input concatenated into $where string"
+        }
+      ],
+      "data_flow": [
+        "req.query.n",
+        "$where string literal",
+        "find"
+      ],
+      "attack_scenario": "A crafted n parameter can alter the JavaScript logic inside $where, potentially bypassing filters or modifying data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0024",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in orders.js:29 via $where with template literal interpolation",
+      "candidate_id": "I-0024",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "line": 28,
+          "code": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+          "why": "User input interpolated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "req.query.shop",
+        "SQL string literal",
+        "db.query"
+      ],
+      "attack_scenario": "A crafted shop parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string interpolation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0025",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in order.cgi:13 via string concatenation",
+      "candidate_id": "I-0025",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 11,
+          "code": "my $id = $q->param('id');",
+          "why": "User input source"
+        },
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "line": 13,
+          "code": "my $sth = $dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "$q->param(id)",
+        "SQL string literal",
+        "prepare"
+      ],
+      "attack_scenario": "A crafted id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0027",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in admin.php:8 via string concatenation",
+      "candidate_id": "I-0027",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 6,
+          "code": "$uid = (int)$_GET['uid'];",
+          "why": "User input source"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 8,
+          "code": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "$_GET(uid)",
+        "$id (from $_POST)",
+        "SQL string literals",
+        "mysql_query"
+      ],
+      "attack_scenario": "A crafted uid or id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify/Delete of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0028",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in admin.php:12 via string concatenation",
+      "candidate_id": "I-0028",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 6,
+          "code": "$uid = (int)$_GET['uid'];",
+          "why": "User input source"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 8,
+          "code": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+          "why": "User input concatenated into SQL string"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "User input concatenated into SQL string"
+        }
+      ],
+      "data_flow": [
+        "$_GET(uid)",
+        "$id (from $_POST)",
+        "SQL string literals",
+        "mysql_query"
+      ],
+      "attack_scenario": "A crafted uid or id parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify/Delete of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0029",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in mongo_find.php:5 via direct request GET parameter usage",
+      "candidate_id": "I-0029",
+      "location": {
+        "file": "php-plain/mongo_find.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 4,
+          "code": "$doc = $coll->findOne(array('login' => $_GET['login'], 'pass' => $_GET['pass']));",
+          "why": "User input passed directly as filter object"
+        },
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 6,
+          "code": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+          "why": "User input concatenated into $where string"
+        }
+      ],
+      "data_flow": [
+        "$_GET(login)",
+        "$_GET(pass)",
+        "$_GET(n)",
+        "filter object / $where string literal",
+        "findOne / find"
+      ],
+      "attack_scenario": "A crafted login, pass, or n parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "INJ-I-0030",
+      "category": "nosql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in mongo_find.php:6 via $where with string concatenation",
+      "candidate_id": "I-0030",
+      "location": {
+        "file": "php-plain/mongo_find.php",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 4,
+          "code": "$doc = $coll->findOne(array('login' => $_GET['login'], 'pass' => $_GET['pass']));",
+          "why": "User input passed directly as filter object"
+        },
+        {
+          "file": "php-plain/mongo_find.php",
+          "line": 6,
+          "code": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+          "why": "User input concatenated into $where string"
+        }
+      ],
+      "data_flow": [
+        "$_GET(login)",
+        "$_GET(pass)",
+        "$_GET(n)",
+        "filter object / $where string literal",
+        "findOne / find"
+      ],
+      "attack_scenario": "A crafted login, pass, or n parameter can alter the SQL logic, potentially bypassing filters or modifying unintended data.",
+      "impact": "Read/Modify of database records; potential for arbitrary data access.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "owasp": [
+        "A03:2021"
+      ],
+      "recommendation": "Use parameterized queries or stored procedures instead of string concatenation.",
+      "status": "unverified"
+    }
+  ],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "I-0001",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0002",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0003",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0004",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0005",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0006",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0007",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0009",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0010",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0011",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0012",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0016",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0017",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0020",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0021",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0022",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0023",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0024",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0025",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0027",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0028",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0029",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "I-0030",
+      "verdict": "vulnerable"
+    }
+  ]
+}