CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 06:50:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Major bug fix to make partial UNION query sql injection work properly

Browse source 
also on Microsoft SQL Server
This commit is contained in:
Bernardo Damele 2008-12-22 19:36:01 +00:00
parent 064029cb2d
commit 1f7810e46a
3 changed files with 50 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

21
lib/request/inject.py
View file

@ -70,13 +70,23 @@ def __goInference(payload, expression):
return value
def __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected=None):
outputs = []
def __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected=None, num=None):
outputs = []
origExpr = None
for field in expressionFieldsList:
output = None
if isinstance(num, int):
origExpr = expression
expression = agent.limitQuery(num, expression, field)
expressionReplaced = expression.replace(expressionFields, field, 1)
if " ORDER BY " in expressionReplaced and "(SELECT " in expressionReplaced:
orderIndex = expressionReplaced.index(" ORDER BY ")
expressionReplaced += expressionReplaced[orderIndex:].replace(")", "")
output = resume(expressionReplaced, payload)
if not output or ( expected == "int" and not output.isdigit() ):
@ -87,6 +97,9 @@ def __goInferenceFields(expression, expressionFields, expressionFieldsList, payl
output = __goInference(payload, expressionReplaced)
if isinstance(num, int):
expression = origExpr
outputs.append(output)
return outputs
@ -252,9 +265,7 @@ def __goInferenceProxy(expression, fromUser=False, expected=None):
return None
for num in xrange(startLimit, stopLimit):
limitedExpr = agent.limitQuery(num, expression, expressionFieldsList)
output = __goInferenceFields(limitedExpr, expressionFields, expressionFieldsList, payload, expected)
output = __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected, num)
outputs.append(output)
return outputs