Lab: Information disclosure in error messages
Summary: PortSwigger's Web Security Academy lab shows that sending a non-integer value such as a string in the productId parameter of a GET /product request causes an exception, and the response returns a full stack trace. That stack trace reveals the application is running Apache Struts 2 version 2.3.31, which the lab asks participants to submit as the solution.
What's compelling: A single malformed request parameter was enough to expose the exact framework and version in use, handing an attacker the fingerprint needed to match against known exploits for that release.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026