From 167956b61c2cdbc2e17c0ddf89237e6cb53ff428 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Thu, 12 Nov 2026 12:57:39 +0100 Subject: [PATCH] Fix for LIMIT n OFFSET m being ignored in SQL queries (e.g. --sql-query) --- lib/core/agent.py | 11 ++++++++++- lib/core/settings.py | 2 +- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index e062ce079..7357f1f35 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -1069,6 +1069,7 @@ class Agent(object): topLimit = re.search(r"TOP\s+([\d]+)\s+", expression, re.I) limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) + limitClause = None if hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query2"): limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I) @@ -1099,6 +1100,12 @@ class Agent(object): elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): if limitRegExp: + + # Note: standard 'LIMIT n OFFSET m' (or 'OFFSET m LIMIT n') isn't (fully) covered by limitregexp (e.g. OFFSET was silently ignored on MySQL) + limitClause = re.search(r"(?i)\s+LIMIT\s+(?P\d+)\s+OFFSET\s+(?P\d+)", expression) or re.search(r"(?i)\s+OFFSET\s+(?P\d+)\s+LIMIT\s+(?P\d+)", expression) + if limitClause: + startLimit, stopLimit = int(limitClause.group("start")), limitClause.group("stop") + limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query @@ -1126,7 +1133,9 @@ class Agent(object): # (or equivalent, depending on the back-end DBMS) word if Backend.getIdentifiedDbms() in limitOffsetAppendDbmses: stopLimit += startLimit - if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0: + if limitClause: + _ = limitClause.start() + elif expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0: _ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) else: _ = re.search(r"\bLIMIT\b", expression, re.I).start() diff --git a/lib/core/settings.py b/lib/core/settings.py index ffd934540..fb34cadf3 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.11.21" +VERSION = "1.10.11.22" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)