{"action":"opened","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2875","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2875/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2875/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2875/events","html_url":"https://github.com/zaproxy/zaproxy/issues/2875","id":177729522,"number":2875,"title":"SQL injection ","user":{"login":"mannemvamsi","id":6283222,"avatar_url":"https://avatars.githubusercontent.com/u/6283222?v=3","gravatar_id":"","url":"https://api.github.com/users/mannemvamsi","html_url":"https://github.com/mannemvamsi","followers_url":"https://api.github.com/users/mannemvamsi/followers","following_url":"https://api.github.com/users/mannemvamsi/following{/other_user}","gists_url":"https://api.github.com/users/mannemvamsi/gists{/gist_id}","starred_url":"https://api.github.com/users/mannemvamsi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mannemvamsi/subscriptions","organizations_url":"https://api.github.com/users/mannemvamsi/orgs","repos_url":"https://api.github.com/users/mannemvamsi/repos","events_url":"https://api.github.com/users/mannemvamsi/events{/privacy}","received_events_url":"https://api.github.com/users/mannemvamsi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-19T08:34:40Z","updated_at":"2016-09-19T08:34:40Z","closed_at":null,"body":"I have a simple app (**https://localhost:port/app/data** ) which displays datatable. Now that table is updated for a 2 minutes.. that url doesn't accept any query parameters. I mean for **/?something=something&other=nothing** .. it will result the same datatable. But zap proxy tool found some parameters in the hidden forms and attacked with **/?hidden_form_name=ZAP AND 1=1** etc..\r\n\r\nIt alerted SQL INJECTION RISK. ( with reason : page was successfully modified with the above parameters). \r\n\r\nwhen I enter the same query parameters, I do not see any changes in the UI ( my datatable is rendered with expected data). \r\n\r\nNow, my question is,  Does ZAP is thinking that it modified the data with its parameters ? Or am I missing something here..?\r\n"}}
{"actor":{"display_login":"mannemvamsi"}}