mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
d4ce173592
classes/class.memberorder.php:936:getMemberOrderByCode, injection. A value concatenated into SQL with no prepare, which is the declared M3 target for PHP, found for the first time. Nothing about detection changed. The population became affordable: tier-zero pruning scoped to its partition, batches budgeted by the sink work they imply, a per-query timeout no longer cancelling the scan, and a reserve kept for arbitration. Before those this population completed zero questions at every budget tried. At 500 regions with a 3,600 s deadline: 271 of 406 questions completed, 213 findings, 2,950 s, and eight findings in the target file including the target itself. The earlier bounded attempt failed for a reason no budget increase could fix -- 25 regions of 4,461 is 0.6 percent of the population and the target was never asked about -- so this sizes the replay before spending hours on it. One scan at this budget is 2,950 s, a push transaction is two scans plus discovery and preparation, so the three declared comparisons are roughly five and a half hours. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo