CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-13 11:25:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix for LIMIT n OFFSET m being ignored in SQL queries (e.g. --sql-query)

Browse source
This commit is contained in:
Miroslav Štampar 2026-11-12 12:57:39 +01:00
parent 3f7f87750a
commit 167956b61c
2 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/core/agent.py
View file

@ -1069,6 +1069,7 @@ class Agent(object):
topLimit = re.search(r"TOP\s+([\d]+)\s+", expression, re.I)
limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I)
limitClause = None
if hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query2"):
limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I)
@ -1099,6 +1100,12 @@ class Agent(object):
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
if limitRegExp:
# Note: standard 'LIMIT n OFFSET m' (or 'OFFSET m LIMIT n') isn't (fully) covered by limitregexp (e.g. OFFSET was silently ignored on MySQL)
limitClause = re.search(r"(?i)\s+LIMIT\s+(?P<stop>\d+)\s+OFFSET\s+(?P<start>\d+)", expression) or re.search(r"(?i)\s+OFFSET\s+(?P<start>\d+)\s+LIMIT\s+(?P<stop>\d+)", expression)
if limitClause:
startLimit, stopLimit = int(limitClause.group("start")), limitClause.group("stop")
limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
@ -1126,7 +1133,9 @@ class Agent(object):
# (or equivalent, depending on the back-end DBMS) word
if Backend.getIdentifiedDbms() in limitOffsetAppendDbmses:
stopLimit += startLimit
if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0:
if limitClause:
_ = limitClause.start()
elif expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0:
_ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query)
else:
_ = re.search(r"\bLIMIT\b", expression, re.I).start()

2
lib/core/settings.py
View file

@ -19,7 +19,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.11.21"
VERSION = "1.10.11.22"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)