{"action":"opened","issue":{"url":"https://api.github.com/repos/webstudiodk/poc/issues/5","repository_url":"https://api.github.com/repos/webstudiodk/poc","labels_url":"https://api.github.com/repos/webstudiodk/poc/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/webstudiodk/poc/issues/5/comments","events_url":"https://api.github.com/repos/webstudiodk/poc/issues/5/events","html_url":"https://github.com/webstudiodk/poc/issues/5","id":326779977,"number":5,"title":"Acunetix - Application error message","user":{"login":"webstudiodk","id":5002443,"avatar_url":"https://avatars1.githubusercontent.com/u/5002443?v=4","gravatar_id":"","url":"https://api.github.com/users/webstudiodk","html_url":"https://github.com/webstudiodk","followers_url":"https://api.github.com/users/webstudiodk/followers","following_url":"https://api.github.com/users/webstudiodk/following{/other_user}","gists_url":"https://api.github.com/users/webstudiodk/gists{/gist_id}","starred_url":"https://api.github.com/users/webstudiodk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webstudiodk/subscriptions","organizations_url":"https://api.github.com/users/webstudiodk/orgs","repos_url":"https://api.github.com/users/webstudiodk/repos","events_url":"https://api.github.com/users/webstudiodk/events{/privacy}","received_events_url":"https://api.github.com/users/webstudiodk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-27T01:36:32Z","updated_at":"2018-05-27T01:36:32Z","closed_at":null,"author_association":"OWNER","body":"| **Target URL** | https://alinco.ro/sikkerhed/|\n------------ | -------------\n| **Severity**   | Medium|\n\n##### Vulnerability Description\n> This alert requires manual confirmation\n\r\n\r\nApplication error or warning messages may expose sensitive information about an application's internal workings to an attacker.\n\n\r\n\r\nAcunetix found an error or warning message that may disclose sensitive information. The message may also contain the location of the file that produced an unhandled exception. Consult the 'Attack details' section for more information about the affected page.\n\n##### Attack Details\nURL encoded POST input **tokenCSRF** was set to **d7c05003fe0038d70d0cf04a8643f721250dc95d**\n\n Pattern found: <span class=\"bb-blue\">&lt;b&gt;Warning&lt;/b&gt;:  htmlspecialchars() expects parameter 1 to be string, array given in &lt;b&gt;/home/webstud3/KUNDER/alinco.ro/sikkerhed/bl-kernel/helpers/sanitize.class.php&lt;/b&gt; on line &lt;b&gt;16&lt;/b&gt;&lt;br /&gt; \n\n##### HTTP Request\n\tPOST /sikkerhed/access/login HTTP/1.1\r\n\tContent-Type: application/x-www-form-urlencoded\r\n\tReferer: https://alinco.ro/sikkerhed/\r\n\tConnection: keep-alive\r\n\tCookie: BLUDIT-KEY=56707c6e2318a5537fa0ce53ad359485\r\n\tAccept: */*\r\n\tAccept-Encoding: gzip,deflate\r\n\tContent-Length: 97\r\n\tHost: alinco.ro\r\n\tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\r\n\t\r\n\tpassword=g00dPa%24%24w0rD&&tokenCSRF[]=d7c05003fe0038d70d0cf04a8643f721250dc95d&username=tsSLAueP\n\n##### Impact\nError messages may disclose sensitive information which can be used to escalate attacks.\n\n##### Remediation\nVerify that this page is disclosing error or warning messages and properly configure the application to log errors to a file instead of displaying the error to the user.\n\n----\n\n##### References:\n[PHP Runtime Configuration](http://www.php.net/manual/en/errorfunc.configuration.php#ini.display-errors)\n[Improper Error Handling](https://www.owasp.org/index.php/Improper_Error_Handling)\n\n"}}
{"actor":{"display_login":"webstudiodk"}}