{"action":"opened","issue":{"url":"https://api.github.com/repos/SpaceDustTeapot/Pin-It/issues/1","repository_url":"https://api.github.com/repos/SpaceDustTeapot/Pin-It","labels_url":"https://api.github.com/repos/SpaceDustTeapot/Pin-It/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/SpaceDustTeapot/Pin-It/issues/1/comments","events_url":"https://api.github.com/repos/SpaceDustTeapot/Pin-It/issues/1/events","html_url":"https://github.com/SpaceDustTeapot/Pin-It/issues/1","id":173889332,"number":1,"title":"SQL Injection Vulnerability","user":{"login":"jlettman","id":20583294,"avatar_url":"https://avatars.githubusercontent.com/u/20583294?v=3","gravatar_id":"","url":"https://api.github.com/users/jlettman","html_url":"https://github.com/jlettman","followers_url":"https://api.github.com/users/jlettman/followers","following_url":"https://api.github.com/users/jlettman/following{/other_user}","gists_url":"https://api.github.com/users/jlettman/gists{/gist_id}","starred_url":"https://api.github.com/users/jlettman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlettman/subscriptions","organizations_url":"https://api.github.com/users/jlettman/orgs","repos_url":"https://api.github.com/users/jlettman/repos","events_url":"https://api.github.com/users/jlettman/events{/privacy}","received_events_url":"https://api.github.com/users/jlettman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-29T22:36:35Z","updated_at":"2016-08-29T22:36:35Z","closed_at":null,"body":"https://github.com/SpaceDustTeapot/Pin-It/blob/master/Post.php#L96\r\n\r\n```php\r\n mysqli_query($CON,\"INSERT INTO posts(isOP,Name,Email,OP,Comment,ImageLoc) VALUES ('1','$name','$email',0,'$comment','$tgtdir')\"); \r\n```\r\n\r\nThe SQL values are concatenated inline with the string. This allows an attacker to arbitrarily inject values into the POSTed values from the form. An example of this would be the following value (sent as a POST variable, such as 'email\"):\r\n\r\n```sql\r\na');DROP TABLE posts;\r\n```"}}
{"actor":{"display_login":"jlettman"}}