{"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/3662","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/3662/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/3662/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/3662/events","html_url":"https://github.com/zaproxy/zaproxy/issues/3662","id":236322251,"number":3662,"title":"SQL Injection false positive","user":{"login":"JCWillard","id":29467671,"avatar_url":"https://avatars2.githubusercontent.com/u/29467671?v=3","gravatar_id":"","url":"https://api.github.com/users/JCWillard","html_url":"https://github.com/JCWillard","followers_url":"https://api.github.com/users/JCWillard/followers","following_url":"https://api.github.com/users/JCWillard/following{/other_user}","gists_url":"https://api.github.com/users/JCWillard/gists{/gist_id}","starred_url":"https://api.github.com/users/JCWillard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JCWillard/subscriptions","organizations_url":"https://api.github.com/users/JCWillard/orgs","repos_url":"https://api.github.com/users/JCWillard/repos","events_url":"https://api.github.com/users/JCWillard/events{/privacy}","received_events_url":"https://api.github.com/users/JCWillard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-06-15T21:41:11Z","updated_at":"2017-06-20T19:38:56Z","closed_at":null,"body":"I'm using ZAP 2.6, Standard mode.\r\nI have white-listed all the parameter inputs.\r\nRunning Active Scan, I get a SQL Injection Alert that I just cannot understand:\r\n\r\nWhen GETing the original page \r\nhttps://localhost:8443/rcrainfoweb/action/modules/br/interstateshiprecv/search , I get my standard error page, a blank html page, as expected. This page requires another missing parameter in order to run and return data.\r\n\r\nWhen GETing the page using the attack \"query OR 1=1 -- \" that is described in \"Other Info\" as:\r\n\"The page results were successfully manipulated using the boolean conditions [query AND 1=1 -- ] and [query OR 1=1 -- ]\r\nThe parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison\r\nData was NOT returned for the original parameter.\r\nThe vulnerability was detected by successfully retrieving more data than originally returned, by manipulating the parameter\"\r\n\r\nThe origianal URL and both of the URL copied from the alert (Attack 1 below) and the secondary attack (Attack 2 below) yield the exact same standard error page, as expected. There is no difference between all three of the html error pages returned. See the attached html error page here => [OR 1=1.txt](https://github.com/zaproxy/zaproxy/files/1079095/OR.1.1.txt)\r\n\r\n\r\n\r\nAttack 1: https://localhost:8443/rcrainfoweb/action/modules/br/interstateshiprecv/search?query=query+AND+1%3D1+--+\r\n\r\nAttack 2: https://localhost:8443/rcrainfoweb/action/modules/br/interstateshiprecv/search?query=query+OR+1%3D1+--+\r\n\r\n**If all three scenarios return a generic and equivalent error page, why is this calling this a successful attack?**\r\n"},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/309865666","html_url":"https://github.com/zaproxy/zaproxy/issues/3662#issuecomment-309865666","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/3662","id":309865666,"user":{"login":"thc202","id":4639210,"avatar_url":"https://avatars3.githubusercontent.com/u/4639210?v=3","gravatar_id":"","url":"https://api.github.com/users/thc202","html_url":"https://github.com/thc202","followers_url":"https://api.github.com/users/thc202/followers","following_url":"https://api.github.com/users/thc202/following{/other_user}","gists_url":"https://api.github.com/users/thc202/gists{/gist_id}","starred_url":"https://api.github.com/users/thc202/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thc202/subscriptions","organizations_url":"https://api.github.com/users/thc202/orgs","repos_url":"https://api.github.com/users/thc202/repos","events_url":"https://api.github.com/users/thc202/events{/privacy}","received_events_url":"https://api.github.com/users/thc202/received_events","type":"User","site_admin":false},"created_at":"2017-06-20T19:38:56Z","updated_at":"2017-06-20T19:38:56Z","body":"Are you able to consistently reproduce the issue?"}}
{"actor":{"display_login":"thc202"}}