Detecting Blind SQLi with ZAP

[True Pentest]

Hello members,

I am working on a Laravel framework that generates a 500 response when I insert a single quote (') to reset a password however, ZAP doesn't trigger a critical alert on this vulnerability. Any idea why ? (from the box HTB usage on Hack the box platform)

  

Thank you.

[Simon Bennetts]

Hiya,

This is a known bug which we have to fix relatively soon.

Cheers,

Simon