{"action":"opened","issue":{"url":"https://api.github.com/repos/perezkarjee/zerocms/issues/3","labels_url":"https://api.github.com/repos/perezkarjee/zerocms/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/perezkarjee/zerocms/issues/3/comments","events_url":"https://api.github.com/repos/perezkarjee/zerocms/issues/3/events","html_url":"https://github.com/perezkarjee/zerocms/issues/3","id":55268426,"number":3,"title":"SQL injection vulnerability in zerocms v. 1.3.2 ","user":{"login":"sroesemann","id":10271154,"avatar_url":"https://avatars.githubusercontent.com/u/10271154?v=3","gravatar_id":"","url":"https://api.github.com/users/sroesemann","html_url":"https://github.com/sroesemann","followers_url":"https://api.github.com/users/sroesemann/followers","following_url":"https://api.github.com/users/sroesemann/following{/other_user}","gists_url":"https://api.github.com/users/sroesemann/gists{/gist_id}","starred_url":"https://api.github.com/users/sroesemann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sroesemann/subscriptions","organizations_url":"https://api.github.com/users/sroesemann/orgs","repos_url":"https://api.github.com/users/sroesemann/repos","events_url":"https://api.github.com/users/sroesemann/events{/privacy}","received_events_url":"https://api.github.com/users/sroesemann/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-23T10:48:40Z","updated_at":"2015-01-23T10:48:40Z","closed_at":null,"body":"Hi Perez.\r\n\r\nI found an SQL injection vulnerability in zerocms v.1.3.2 (release-date: 5th-Nov-2014).\r\n\r\nIf you are interested in the technical details to provide a patch, please name an email address where I should send my issue to. Else, if you don't mind, I could post directly here.\r\n\r\nI will release a security advisory on this issue (without technical details, see http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html). If you do not respond until 6th February 2015 (UTC+1), I will as well release the technical details and submit the issue to the security mailing list FullDisclosure.\r\n\r\nThank you for your attention.\r\n\r\nGreetings from Germany.\r\n\r\nSteffen Rösemann"}}