When reviewing an error report generated for an SQL injection incident (see https://traclabs.fastfixproject.eu/ticket/1488), I made the following observations that I propose to change in order to create an error report that is more understandable and better supporting the developer:
-
- Text input event:
User and client IP address seems to be switched.
What is "Last active window" and "WCF protocol timestamp"? I would remove this.
-
- DATABASE TRANSACTION:
Do we have information about the SQL statement that was executed? Would be nice to show it here.
- HTTP Request missing
I am missing the HTTP request event here in which the SQL injection input was transported to the server.
Former ticket Nr. 686
Diff: