A vulnerability

#!/usr/bin/env python3
# check_cve_2025_0208.py
# Detect likely vulnerable code patterns for CVE-2025-0208 in code-projects Online Shoe Store 1.0.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
from pathlib import Path

VULN_GET_RE = re.compile(r"\$_GET\s*\[\s*['\"]tid['\"]\s*\]")
VULN_ASSIGN_RE = re.compile(r"\$\w+\s*=\s*\$_GET\s*\[\s*['\"]tid['\"]\s*\]\s*;")
VULN_QUERY_RE = re.compile(r"transaction_id\s*=\s*'\s*\$\w+\s*'", re.IGNORECASE)
SAFE_CAST_RE = re.compile(r"(intval\s*\(|\(int\)\s*\$_GET\s*\[\s*['\"]tid['\"]\s*\])", re.IGNORECASE)
PREPARED_RE = re.compile(r"(prepare\s*\(|bind_param\s*\(|PDO\s*::\s*prepare)", re.IGNORECASE)


def read_text(p: Path):
    try:
        return p.read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return None


def candidate_files(target: Path):
    if target.is_file():
        return [target]
    found = []
    for p in target.rglob('summary.php'):
        found.append(p)
    return found


def assess_file(p: Path):
    text = read_text(p)
    if text is None:
        return 'UNKNOWN', f'{p}: unreadable'

    has_get = bool(VULN_GET_RE.search(text))
    has_assign = bool(VULN_ASSIGN_RE.search(text))
    has_query = bool(VULN_QUERY_RE.search(text))
    has_safe_cast = bool(SAFE_CAST_RE.search(text))
    has_prepared = bool(PREPARED_RE.search(text))

    if has_get and has_query and not has_safe_cast and not has_prepared:
        return 'VULNERABLE', f'{p}: raw tid parameter appears interpolated into SQL query'

    if has_prepared or has_safe_cast:
        return 'PATCHED', f'{p}: found parameterization or strict integer casting for tid'

    if has_get or has_assign or has_query:
        return 'UNKNOWN', f'{p}: suspicious markers found, but pattern does not conclusively match CVE-2025-0208'

    return 'UNKNOWN', f'{p}: summary.php present, but expected markers were not found'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2025_0208.py <path-to-app-or-summary.php>')
        sys.exit(2)

    target = Path(sys.argv[1])
    if not target.exists():
        print(f'UNKNOWN - target does not exist: {target}')
        sys.exit(2)

    files = candidate_files(target)
    if not files:
        print('UNKNOWN - no summary.php file found under target path')
        sys.exit(2)

    saw_patched = False
    saw_unknown = False
    messages = []

    for f in files:
        verdict, msg = assess_file(f)
        messages.append(msg)
        if verdict == 'VULNERABLE':
            print('VULNERABLE - ' + ' | '.join(messages))
            sys.exit(1)
        if verdict == 'PATCHED':
            saw_patched = True
        if verdict == 'UNKNOWN':
            saw_unknown = True

    if saw_patched and not saw_unknown:
        print('PATCHED - ' + ' | '.join(messages))
        sys.exit(0)

    if saw_patched and saw_unknown:
        print('UNKNOWN - mixed results: ' + ' | '.join(messages))
        sys.exit(2)

    print('UNKNOWN - ' + ' | '.join(messages))
    sys.exit(2)


if __name__ == '__main__':
    main()