---
description: >-
  https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-error-messages
---

# Information disclosure in error messages

## Description

This lab's verbose error messages reveal that it is using a vulnerable version of a third-party framework. To solve the lab, obtain and submit the version number of this framework.

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fq7EcdhzPgnPbttZtWJxJ%2Fimage.png?alt=media&#x26;token=20ad4cb6-8803-4b2b-9790-93497b4d629e" alt=""><figcaption></figcaption></figure>

Checking into page source code there're not of interesting, so click to one of products shop: [https://0a6c00fe03599c7f8a11a3f700100029.web-security-academy.net/product?productId=1](https://0a6c00fe03599c7f8a11a3f700100029.web-security-academy.net/product?productId=1)

the idea is to generate and error, than we try to inject something with a SQLi:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F9wxTYLj2Nb1EebgdTQkD%2Fimage.png?alt=media&#x26;token=1851a3a2-52eb-47fe-a24f-effdf644371f" alt=""><figcaption></figcaption></figure>

and obtaining an error by Apache Struts 2 2.3.31 we've discovered the vs number of this framework.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FsRDFOtVK2Bd7VYjHtq2u%2Fimage.png?alt=media&#x26;token=dbb9bbf3-d195-4530-bf60-43de1e7a1f3c" alt=""><figcaption></figcaption></figure>
