zaproxy / zaproxy

The ZAP core project
https://www.zaproxy.org
Apache License 2.0
12.21k stars 2.21k forks source link

false positive of sql Injection #8503

Open ziadtoa opened 4 weeks ago

ziadtoa commented 4 weeks ago

Describe the bug

The app in giving: https://nacc.gov.lb/en/commission-news-page/?csrf_token=edd354c1bd75595c3c7a7c333d815e7596bcc26dd6cac7d397ddf4e9dcdc0954&title=ZAP&year-select=2024

" | case randomblob(1000000) when not null then "" else "" end | " image

as sql injection. I have tried to insert this link but my wordpress threw the call. I am using wordfence as a plugin. your keeps showing me that there is an injection. How can I prove it is a false positive since when I try the injections detected by your app the wordpress sites throw them all.

Steps to reproduce the behavior

image

Expected behavior

Expected not to se this as sql injection since we tested this directly on the website and it doesn't accept the url

Software versions

Woordpress with wordfence plugin

Screenshots

No response

Errors from the zap.log file

No response

Additional context

No response

Would you like to help fix this issue?