{'context_id': 426, 'vulnerable': True, 'processing': False, 'request': {'url': 'https://perez.com/explorelogin.php', 'method': 'PUT', 'headers': {'HOST': '127.0.0.1:5000', 'USER_AGENT': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0', 'ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE': 'en-US,en;q=0.5', 'ACCEPT_ENCODING': 'gzip, deflate, br, zstd', 'CONNECTION': 'keep-alive', 'REFERER': 'http://127.0.0.1:5000/sql-injection/login', 'COOKIE': 'csrftoken=7GgBqVlBL6WuGdfu3e6EBXep8N5vFiVm; grafana_session=54c841e9cb2f4956a7c791efd284d120; grafana_session_expiry=1735995560; user_id=2; session_token=b3c634c91e1711c794704a031918a34b', 'UPGRADE_INSECURE_REQUESTS': '1', 'SEC_FETCH_DEST': 'document', 'SEC_FETCH_MODE': 'navigate', 'SEC_FETCH_SITE': 'same-origin', 'SEC_FETCH_USER': '?1', 'PRIORITY': 'u=0, i', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (iPod; U; CPU iPhone OS 3_2 like Mac OS X; ta-LK) AppleWebKit/533.8.6 (KHTML, like Gecko) Version/4.0.5 Mobile/8B113 Safari/6533.8.6'}, 'body': b'csrfmiddlewaretoken=99a63ec6-0677-47e7-8ec4-503e4b5df7c5&newpass1=XWL0p0g3&newpass2=rT66rEfs'}, 'control_flow': {0: "api_key = request.cookies.get('api_key')", 1: 'if API_KEY is None or api_key == API_KEY:', 2: 'return f(*args, **kwargs)', 3: 'pass', 4: 'return sql_injection_search_page(request, app)', 5: "search = request.args.get('q')", 6: 'sql = f"SELECT * FROM products WHERE name LIKE \'%{search}%\'"', 7: 'db_result = app.db_helper.execute_read(sql)', 8: 'con = None', 9: 'try:', 10: 'con = self._get_db_connection()', 11: 'return sqlite3.connect(self.DB_FILE_PATH)', 12: 'cur = con.cursor()', 13: 'cur.execute(sql, params)', 14: 'result = cur.fetchall()', 15: 'return result', 16: 'if con is not None:', 17: 'con.close()', 18: 'return result', 19: 'products = list(', 20: 'map(', 21: 'lambda p: {', 22: 'db_result', 23: 'map(', 24: 'products = list(', 25: "'id': p[0],", 26: "'name': p[1],", 27: "'price': p[2]", 28: 'lambda p: {', 29: "'id': p[0],", 30: "'name': p[1],", 31: "'price': p[2]", 32: 'lambda p: {', 33: 'return render_template(', 34: "'sql_injection/search.html',", 35: 'sql=sql,', 36: 'products=products', 37: 'return render_template(', 38: '{% extends "base.html" %}', 39: '{% block content %}', 40: '', 41: '<h1 class="title">SQL Injection - Search</h1>', 42: '<div class="control">', 43: '<td>{{ product.id }}</td>', 44: '<td>{{ product.name }}</td>', 45: '', 46: '<div class="block">', 47: '<pre>', 48: '</pre>', 49: '', 50: '<div class="block">', 51: '<form action="/sql-injection/search" method="get" style="max-width: 300px;">', 52: '<div class="block">', 53: '<form action="/sql-injection/search" method="get" style="max-width: 300px;">', 54: '<div class="block">', 55: '<div class="field">', 56: '<meta name="viewport" content="width=device-width, initial-scale=1.0">', 57: '<link rel="stylesheet" href="{{ url_for(\'static\', filename=\'assets/bulma.min.css\') }}">', 58: '<title>Vuln Python App</title>', 59: '<body>', 60: '{% include "./components/navbar.html" %}', 61: '<section class="section">', 62: '{% block content %}{% endblock %}', 63: '</div>', 64: '</section>', 65: '', 66: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 67: '', 68: '<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="False" data-target="navbarBasicExample">', 69: '<span aria-hidden="True"></span>', 70: '<span aria-hidden="True"></span>', 71: '</div> -->', 72: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 73: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 74: '', 75: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 76: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 77: '<div id="navbarBasicExample" class="navbar-menu">', 78: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 79: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 80: '<div class="navbar-start">', 81: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 82: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 83: '<a class="navbar-item" href="{{ url_for(\'home\') }}">', 84: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 85: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 86: 'Home', 87: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 88: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 89: '</a>', 90: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 91: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 92: '', 93: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 94: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 95: '<div class="navbar-item has-dropdown is-hoverable">', 96: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 97: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 98: '<a class="navbar-link">', 99: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 100: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 101: 'SQL Injection', 102: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 103: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 104: '</a>', 105: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 106: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 107: '', 108: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 109: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 110: '<div class="navbar-dropdown">', 111: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 112: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 113: '<a class="navbar-item" href="{{ url_for(\'sql_injection_login\') }}">', 114: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 115: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 116: 'Login', 117: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 118: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 119: '</a>', 120: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 121: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 122: '<a class="navbar-item" href="{{ url_for(\'sql_injection_search\') }}?q=">', 123: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 124: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 125: 'Search', 126: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 127: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 128: '</a>', 129: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 130: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 131: '</div>', 132: '<script src="{{ url_for(\'static\', filename=\'assets/global.js\') }}"></script>', 133: '<script src="{{ url_for(\'static\', filename=\'assets/axios.min.js\') }}"></script>', 134: '<script>', 135: "// var googleCaptchaKey = '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI';", 136: '<input class="input" name="q" type="text" placeholder="product...">', 137: '</div>', 138: '</div>', 139: '<div class="field is-grouped">', 140: '<div class="control">', 141: '<button class="button is-link">Search</button>', 142: '</div>', 143: '</form>', 144: '</div>', 145: '', 146: '<div class="block">', 147: '<thead>', 148: '<tr>', 149: '<th>ID</th>', 150: '<th>Name</th>', 151: '<th>Price</th>', 152: '</tr>', 153: '</thead>', 154: '', 155: '<div class="block">', 156: '<thead>', 157: '<tr>', 158: '<th>ID</th>', 159: '<th>Name</th>', 160: '<th>Price</th>', 161: '</tr>', 162: '</thead>', 163: '', 164: '<tbody>', 165: '{% for product in products %}', 166: "// var googleCatpchaSecretKey = '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe';", 167: '', 168: "var googleCaptchaKey = '{{ GOOGLE_RECAPTCHA_SITE_KEY }}';", 169: "var googleCatpchaSecretKey = '{{ GOOGLE_RECAPTCHA_SECRET_KEY }}';", 170: '', 171: '</script>', 172: '', 173: '{% block js %}{% endblock %}', 174: '</body>', 175: '</html>', 176: 'None', 177: 'None', 178: 'None', 179: 'None', 180: 'None', 181: '</html>'}, 'response': {'status_code': '301', 'headers': {'Content-Type': 'text/html; charset=utf-8', 'Content-Length': '4249'}}}