{"action":"opened","issue":{"url":"https://api.github.com/repos/gitpay/website/issues/7","repository_url":"https://api.github.com/repos/gitpay/website","labels_url":"https://api.github.com/repos/gitpay/website/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/gitpay/website/issues/7/comments","events_url":"https://api.github.com/repos/gitpay/website/issues/7/events","html_url":"https://github.com/gitpay/website/issues/7","id":197783909,"number":7,"title":"Major SQL injection vulnerability","user":{"login":"ezekg","id":6979737,"avatar_url":"https://avatars.githubusercontent.com/u/6979737?v=3","gravatar_id":"","url":"https://api.github.com/users/ezekg","html_url":"https://github.com/ezekg","followers_url":"https://api.github.com/users/ezekg/followers","following_url":"https://api.github.com/users/ezekg/following{/other_user}","gists_url":"https://api.github.com/users/ezekg/gists{/gist_id}","starred_url":"https://api.github.com/users/ezekg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ezekg/subscriptions","organizations_url":"https://api.github.com/users/ezekg/orgs","repos_url":"https://api.github.com/users/ezekg/repos","events_url":"https://api.github.com/users/ezekg/events{/privacy}","received_events_url":"https://api.github.com/users/ezekg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-28T02:05:56Z","updated_at":"2016-12-28T02:05:56Z","closed_at":null,"body":"As discussed [on Hacker News](https://news.ycombinator.com/item?id=13265743), your site is vulnerable to SQL injection in many, many places. You seem to be using [string interpolation](https://github.com/gitpay/website/blob/master/functions.php#L94) instead of [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php).\r\n\r\n## Example Request\r\n_Note: the database name has been changed to avoid dropping the actual database._\r\n\r\n```\r\nhttp://gitpay.org/user.php?user=%27%3B%20DROP%20DATABASE%20database_name%3B%20%27\r\n```\r\n\r\nFrom the Hacker News discussion, I saw that you had your database dropped. Sorry that happened, and I hope that you'll be able to patch the vulnerability for the future.\r\n\r\nGood luck. 👍 "}}
{"actor":{"display_login":"ezekg"}}