code-projects Online Shoe Store 1.0 details.php SQL injection via id

#!/usr/bin/env python3
"""
verify_cve_2025_0204.py

Static verifier for CVE-2025-0204 in code-projects Online Shoe Store 1.0.
Checks whether details.php appears to read $_GET['id'] and interpolate it
into the product query without prepared statements.

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
  3 = USAGE ERROR
"""

import os
import re
import sys
from pathlib import Path

VULN_PATTERNS = [
    re.compile(r"\$_GET\s*\[\s*['\"]id['\"]\s*\]", re.I),
    re.compile(r"\$id\s*=\s*\$_GET\s*\[\s*['\"]id['\"]\s*\]", re.I),
    re.compile(r"SELECT\s+\*\s+FROM\s+product\s+WHERE\s+product_id\s*=\s*['\"]\$id['\"]", re.I),
    re.compile(r"query\s*\(\s*['\"].*product_id\s*=\s*['\"]\$id['\"]", re.I | re.S),
]

SAFE_HINTS = [
    re.compile(r"prepare\s*\(", re.I),
    re.compile(r"bind_param\s*\(", re.I),
    re.compile(r"PDO\s*::\s*prepare", re.I),
    re.compile(r"mysqli_prepare\s*\(", re.I),
    re.compile(r"intval\s*\(\s*\$_GET\s*\[\s*['\"]id['\"]\s*\]\s*\)", re.I),
    re.compile(r"filter_input\s*\(\s*INPUT_GET\s*,\s*['\"]id['\"]", re.I),
]


def load_file(base: Path):
    candidates = [
        base / "details.php",
        base / "onl shoe" / "details.php",
        base / "online shoe store" / "details.php",
    ]

    for candidate in candidates:
        if candidate.is_file():
            try:
                return candidate, candidate.read_text(encoding="utf-8", errors="ignore")
            except Exception:
                pass

    found = list(base.rglob("details.php"))
    for candidate in found:
        if candidate.is_file():
            try:
                return candidate, candidate.read_text(encoding="utf-8", errors="ignore")
            except Exception:
                continue

    return None, None


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN")
        print("Usage: python verify_cve_2025_0204.py <application_root>", file=sys.stderr)
        sys.exit(3)

    root = Path(sys.argv[1]).expanduser().resolve()
    if not root.exists() or not root.is_dir():
        print("UNKNOWN")
        print(f"Path not found or not a directory: {root}", file=sys.stderr)
        sys.exit(2)

    target, content = load_file(root)
    if not target or content is None:
        print("UNKNOWN")
        print("details.php not found under supplied root", file=sys.stderr)
        sys.exit(2)

    vuln_hits = sum(1 for p in VULN_PATTERNS if p.search(content))
    safe_hits = sum(1 for p in SAFE_HINTS if p.search(content))

    if vuln_hits >= 3 and safe_hits == 0:
        print("VULNERABLE")
        print(f"Matched vulnerable code pattern in: {target}")
        sys.exit(1)

    if safe_hits >= 1 and vuln_hits < 3:
        print("PATCHED")
        print(f"Found sanitization/prepared-statement indicators in: {target}")
        sys.exit(0)

    print("UNKNOWN")
    print(f"Manual review needed for: {target}")
    sys.exit(2)


if __name__ == "__main__":
    main()