POJIA破甲
地图 / SQL exception in JSON format

SQL exception in JSON format

信息泄露 / 错误信息泄露 / #225098

厂商
Nextcloud
严重程度
低危
赏金
—
弱点
错误信息泄露
研究员
@clizsec
披露日期
2020-01-31
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1398 字符中的一小部分)
Hi, I know this is not critical, just a design issue, but it will be better if it will not show up to the user as an error, maybe in log files readable to the www-user or to the root user in order to debug.
原文中的代码
{"message":"An exception occurred while executing 'INSERT INTO `oc_users` ( `uid`, `password` ) VALUES( ?, ? )' with params [\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\", \"1|$2y$10$gwzH19jqn8HveRpCb2haNurF7rycqsZeYYS7b1zPENnUInUyP35J2\"]:\n\nSQLSTATE[23000]: Integrity …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @clizsec · 版权归作者与 Nextcloud 所有

同类报告

information disclosure of secret_key_base via encoding charctersGitLab · 2019-06-13 · $3,500Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeoverU.S. Dept Of Defense · 2024-10-25A HackerOne employee's GitHub personal access token exposed in Travis CI build logsHackerOne · 2017-05-23 · $2,000internal path disclosure via register errorTennessee Valley Authority · 2023-11-30phone number exposure for riders/drivers given email/uuidUber · 2017-06-02The impossibility of inclusion of the trial (BROWSER)New Relic · — · $200