mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
38 lines
2.9 KiB
JSON
38 lines
2.9 KiB
JSON
|
{
|
||
|
|
"are_the_other_fifteen_noise": {
|
||
|
|
"answer": "No. The file is systemically unprepared.",
|
||
|
|
"counted": {
|
||
|
|
"engine_entailed": 16,
|
||
|
|
"unprepared_with_a_variable": 26,
|
||
|
|
"using_prepare": 0,
|
||
|
|
"wpdb_query_calls": 26
|
||
|
|
},
|
||
|
|
"reading": "Every sampled finding is a genuine unprepared query. The engine reports 16 of 26 such sites, so it UNDER-reports rather than over-reports here. CVE-2023-23488 is simply the instance that got an identifier, because it is reachable unauthenticated; the rest are the same defect with different reachability.",
|
||
|
|
"sampled": {
|
||
|
|
"1073": "get_row(\"... WHERE ID = '\" . $this->user_id . \"'\")",
|
||
|
|
"1512": "get_var(\"... WHERE code = '$code' LIMIT 1\")",
|
||
|
|
"671": "get_row(\"... WHERE id = '$id' LIMIT 1\")",
|
||
|
|
"705": "get_var(\"... WHERE ID = '\" . $this->user_id . \"'\")"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"generated": "2026-09-09",
|
||
|
|
"on_cutting_the_input_with_a_model": "Proposed by the maintainer when size looked like the blocker. The evidence argues for scoping rather than triage: two of 637 files found the CVE in 122 seconds, and task 2.10 already scopes by what a project declares it ships while diff-scoping is this spec's actual thesis. A model deciding what to cut adds a FIFTH quiet-failure surface -- if it drops the file holding the bug, the scan reports clean and nothing records why, which is the exact shape of all four failures found today. The reverse direction is where a model fits: not choosing what to remove, but ranking which regions get the budget first.",
|
||
|
|
"reading": "CVE-2023-23488 is detected at classes/class.memberorder.php:936:getMemberOrderByCode -- the exact line verified in the source, in unmodified plugin code. The engine works; what has been unfit is the plumbing around it, which produced four separate quiet failures on this one checkout before a CPG it could load reached the arbiter.",
|
||
|
|
"scan": {
|
||
|
|
"build_seconds": 9.0,
|
||
|
|
"cve_found": "model_entailed injection class.memberorder.php:936:getMemberOrderByCode",
|
||
|
|
"entailed": 16,
|
||
|
|
"input": "two files carrying both ends of the CVE: classes/class.memberorder.php and includes/rest-api.php, 2885 lines",
|
||
|
|
"query_seconds": 110.9,
|
||
|
|
"regions": 57,
|
||
|
|
"total_seconds": 122.0
|
||
|
|
},
|
||
|
|
"spec": "contributor-scan 5.10 -- the first real CVE found in production code",
|
||
|
|
"what_it_does_not_settle": [
|
||
|
|
"The full 637-file checkout still does not load, and that boundary is unmeasured.",
|
||
|
|
"Whether php2cpg resolves `new X()` and `$this->method()` is still unknown -- this slice found the sink through a same-function flow, not through the REST handler two calls away.",
|
||
|
|
"One CVE on one plugin. The class-by-class table over several plugins (5.8) is still the artifact worth teaching from."
|
||
|
|
],
|
||
|
|
"what_this_settles": "The question was whether the system can find one real CVE. It can, in production code, at the exact line, in two minutes, for a cent. What it could not do was survive its own plumbing at 637 files."
|
||
|
|
}
|