{'context_id': 494, 'vulnerable': True, 'processing': False, 'request': {'url': 'https://nguyen.biz/blog/categories/tagspost.php', 'method': 'PATCH', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'ORIGIN': 'http://127.0.0.1:5000', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/guestbook', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b; session=eyJjc3JmX3Rva2VuIjoiMzNkNDNlNjA2MDhiMjdjZjBiMGI1Yzk3NWU4MDExZjRjYWMxMzRhNyJ9.Z5GBRA.Q8r4qzslZbU-6Y0h-x9F551fn1A', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows; U; Windows 98; Win 9x 4.90) AppleWebKit/533.42.2 (KHTML, like Gecko) Version/4.1 Safari/533.42.2'}, 'body': b'csrfmiddlewaretoken=692893e7-f28d-4dfa-898a-d173b3cb2db9&newpass1=glLaHMRk&newpass2=XNvQhuDB'}, 'control_flow': {0: "search_query = request.args.get('q')", 1: 'comments = db.get(search_query)', 2: 'db = init()', 3: "db = sqlite3.connect('data.db')", 4: "db.cursor().execute('CREATE TABLE IF NOT EXISTS comments (id INTEGER PRIMARY KEY, comment TEXT, date TEXT)')", 5: 'return db', 6: 'results = []', 7: "for(comment, date) in db.cursor().execute('SELECT comment, date FROM comments').fetchall():", 8: 'if query is None or query in comment:', 9: 'results.append((comment, date))', 10: "for(comment, date) in db.cursor().execute('SELECT comment, date FROM comments').fetchall():", 11: 'if query is None or query in comment:', 12: 'results.append((comment, date))', 13: "for(comment, date) in db.cursor().execute('SELECT comment, date FROM comments').fetchall():", 14: 'return results', 15: 'form = forms.AddCommentForm()', 16: 'if form.validate_on_submit():', 17: 'db.add(form.comment.data)', 18: 'db = init()', 19: "db = sqlite3.connect('data.db')", 20: "db.cursor().execute('CREATE TABLE IF NOT EXISTS comments (id INTEGER PRIMARY KEY, comment TEXT, date TEXT)')", 21: 'return db', 22: "db.cursor().execute('INSERT INTO comments (comment, date) VALUES (?, ?)', (comment, datetime.utcnow().strftime('%B %d %Y - %H:%M')))", 23: 'db.commit()', 24: "return redirect(url_for('guestbook'))"}, 'response': {'status_code': '401', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '207', 'Location': '/guestbook', 'Vary': 'Cookie'}}}