| tiêu đề | jofpin trape latest (main/master branch) CWE-362 (Race Condition / TOCTOU) |
|---|
| Mô tả | The /register endpoint enforces the business rule "each vId maps to exactly one victim record set" via a non-atomic check-then-act sequence. It first queries count_times (number of prior clicks for the vId) and then decides whether to INSERT or UPDATE. The check and the subsequent writes are separate SQL statements with no transaction boundary, no database-level lock, and no UNIQUE constraint on the victims, victims_data, or victims_battery tables. Since vId is fully attacker-controlled (submitted via POST form data), concurrent requests carrying the same vId can both observe cant == 0 and both proceed down the INSERT branch, creating duplicate victim records. Additionally, the geo table has a PRIMARY KEY on id, so the second concurrent INSERT into geo raises an unhandled sqlite3.IntegrityError, leaving the database in an inconsistent state with duplicate victim rows but no corresponding geo record. Exploitation: An attacker sends two (or more) concurrent POST requests to /register with the same vId value (e.g., vId=test123). Both requests execute count_times('test123') before either has committed its insert_click, so both see cant == 0. Both then INSERT into victims, victims_data, and victims_battery. When both attempt INSERT into geo, one succeeds and the other raises an IntegrityError (500 error). The database now contains duplicate victim records for the same vId, corrupting all downstream analytics and victim-tracking logic that assume one row per vId. |
|---|
| Nguồn | ⚠️ https://github.com/jofpin/trape/issues/408 |
|---|
| Người dùng | GalaxynC (UID 98975) |
|---|
| Đệ trình | 18/07/2026 21:38 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 06/09/2026 20:25 (2 months later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 398787 [jofpin trape 2.0 Telemetry Endpoint core/user.py vId điều kiện tranh chấp] |
|---|
| điểm | 0 |
|---|