CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-15 12:29:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix REST API multi-target scans returning only the last target's results (#2503) (#6146)

Browse source 
A scan covering multiple targets inside a single API task (crawl,
'-m' bulk file, forms) ran every target through one StdDbOut keyed by
the single taskid, so _storeData()'s COMPLETE branch deleted each
earlier target's TARGET/TECHNIQUES rows - /scan/<id>/data returned
only the last target's results.

Mirror the --report-json fix for #6123: controller.start() now sets
kb.reportTaskId per target for API scans too, StdDbOut.write() keys
data rows '<taskid>-<n>' per target, and scan_data() folds the
per-target rows back into the task's flat result in target order.
Single-target scans keep the exact same response shape.

Regression tests in tests/test_api.py (TestStdDbOutMultiTarget,
TestScanDataMultiTarget).
This commit is contained in:
Bharath Vemula 2026-10-17 04:02:34 -07:00 • committed by GitHub
parent c94f6d0041
commit 0cf2f6db07
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 104 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/controller/controller.py
View file

@ -376,9 +376,10 @@ def start():
for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets:
targetCount += 1
# --report-json: give each target its own taskid in the shared collector, so a multi-target
# run (e.g. '-m' bulk file) doesn't have later targets overwrite earlier ones (see _reportData)
if conf.reportJson:
# --report-json / REST API: give each target its own taskid in the shared collector, so a
# multi-target run (e.g. '-m' bulk file) doesn't have later targets overwrite earlier ones
# (see _reportData for the report collector and StdDbOut.write for the REST API IPC database)
if conf.reportJson or conf.api:
kb.reportTaskId = targetCount
try: