{'context_id': 458, 'vulnerable': True, 'processing': False, 'request': {'url': 'https://smith.com/tag/tagprivacy.asp', 'method': 'PATCH', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/xss/reflected?search=%3Cscript%3Ealert%28%22%D0%B4%D0%B0%D1%80%D0%BE%D0%B2%D0%B0%22%29%3B%3C%2Fscript%3E', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.0; Trident/4.0)'}, 'body': b'csrfmiddlewaretoken=141f47b4-6b05-4264-8c4e-563d86bfd3e1&newpass1=GnC3FXtj&newpass2=UbiNCQwL'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: 'return xss_reflected_page(request, app)', 5: "search = request.args.get('search')", 6: 'products = app.db_helper.execute_read(', 7: 'f"SELECT * FROM products WHERE name LIKE :search",', 8: "{ 'search': f'%{search}%' }", 9: 'products = app.db_helper.execute_read(', 10: 'con = None', 11: 'try:', 12: 'con = self._get_db_connection()', 13: 'return sqlite3.connect(self.DB_FILE_PATH)', 14: 'cur = con.cursor()', 15: 'cur.execute(sql, params)', 16: 'result = cur.fetchall()', 17: 'return result', 18: 'if con is not None:', 19: 'con.close()', 20: 'return result', 21: 'products = list(', 22: 'map(', 23: 'lambda p: {', 24: 'products', 25: 'map(', 26: 'products = list(', 27: 'return render_template(', 28: "'xss-reflected.html',", 29: 'products=products', 30: 'return render_template(', 31: '', 32: '', 33: '', 34: '<p>', 35: '', 36: '{% autoescape False %}', 37: "{{ request.args.get('search') }}", 38: '{% autoescape False %}', 39: "{{ request.args.get('search') }}", 40: '{% autoescape False %}', 41: '{% endautoescape %}', 42: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 43: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 44: '<title>Vuln Python App</title>', 45: '<body>', 46: '{% include "./components/navbar.html" %}', 47: '<section class="section">', 48: '{% block content %}{% endblock %}', 49: '</div>', 50: '</section>', 51: '', 52: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 53: '', 54: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 55: '<span aria-hidden="True"></span>', 56: '<span aria-hidden="True"></span>', 57: '</div> -->', 58: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 59: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 60: '', 61: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 62: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 63: '<div id="navbarBasicExample" class="navbar-menu">', 64: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 65: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 66: '<div class="navbar-start">', 67: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 68: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 69: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 70: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 71: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 72: 'Home', 73: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 74: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 75: '</a>', 76: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 77: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 78: '', 79: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 80: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 81: '<div class="navbar-item has-dropdown is-hoverable">', 82: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 83: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 84: '<a class="navbar-link">', 85: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 86: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 87: 'SQL Injection', 88: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 89: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 90: '</a>', 91: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 92: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 93: '', 94: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 95: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 96: '<div class="navbar-dropdown">', 97: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 98: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 99: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 100: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 101: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 102: 'Login', 103: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 104: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 105: '</a>', 106: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 107: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 108: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 109: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 110: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 111: 'Search', 112: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 113: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 114: '</a>', 115: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 116: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 117: '</div>', 118: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 119: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 120: '<script>', 121: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 122: '', 123: '<div class="block">', 124: '<form action="/xss/reflected" method="get" style="max-width: 300px;">', 125: '<label class="label">Search</label>', 126: '<div class="control">', 127: '</div>', 128: '</div>', 129: '<div class="field is-grouped">', 130: '<div class="control">', 131: '<button class="button is-link">Search</button>', 132: '</div>', 133: '</div>', 134: '</form>', 135: '</div>', 136: '', 137: '<div class="block">', 138: '{% for product in products %}', 139: '<tr>', 140: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 141: '', 142: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 143: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 144: '', 145: '</script>', 146: '', 147: '{% block js %}{% endblock %}', 148: '</body>', 149: '</html>', 150: 'None', 151: 'None', 152: 'None', 153: 'None', 154: 'None', 155: '</html>'}, 'response': {'status_code': '201', 'headers': {'Content-Type': 'application/json', 'Content-Length': '4033'}}}