T09 · Insecure Skill Coding Practices
Error
- Location
scripts/zhuocha_finder.py:52- Finding
Second-Order SQL Injection Through Interpolated Database Identifiers
- Content
View full analysis
= {min_count} AND COUNT(*) <= {max_count} ORDER BY cnt DESC LIMIT {limit} """ else: sql = f""" SELECT reid, COUNT(*) as cnt FROM {TABLE_RE} WHERE reid NOT IN ({','.join(f"'{r}'" for r in done)}) GROUP BY reid HAVING COUNT(*) = {min_count} ORDER BY RANDOM() LIMIT {limit} """ ``` ```python def get_jy_fields(reid): """获取分组内所有 jy_id 的字段""" sql = f""" SELECT jy_id, customer_standard_new, title, proj_name, type FROM {TABLE_RE} WHERE reid = '{reid}' ORDER BY jy_id """ result = rp(API_6100, {"sql": sql}) if result and result.get("success"): return result["data"] return [] def get_detail(jy_id, limit=200): """获取原始正文前 N 字""" sql = f"SELECT LEFT(detail, {limit}) as detail, att_ext FROM public.ods_bid_content WHERE jy_id = '{jy_id}'" result = rp(API_5100, {"sql": sql}) ``` ### Technical Analysis The script embeds `reid` and `jy_id` values directly into SQL string literals without parameterization or escaping. These values are obtained from database-backed API responses and subsequently reused in new SQL statements. This creates a second-order SQL-injection vulnerability: a malicious value stored in the source database can become executable SQL when processed by the script. The `done` collection is similarly expanded into a `NOT IN` clause by surrounding each untrusted value with quotes. A quote embedded in any stored identifier can terminate the intended string literal and change the query structure. The consequ ...[truncated 1689 chars]- Remediation
View remediation