From 4b8c39e424488498eee60ea68130dc5fc4d7f17f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Thu, 12 Nov 2026 16:25:57 +0100 Subject: [PATCH] Fix for --param-filter=POST not matching JSON/XML bodies --- lib/controller/controller.py | 2 +- lib/core/settings.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/controller/controller.py b/lib/controller/controller.py index 3a44f6cff..2413233d0 100644 --- a/lib/controller/controller.py +++ b/lib/controller/controller.py @@ -636,7 +636,7 @@ def start(): skip |= (place == PLACE.REFERER and (kb.testOnlyCustom or conf.level < 3)) # --param-filter - skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter) + skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter and place.upper().replace("(CUSTOM) ", "") not in conf.paramFilter) # Note: e.g. POST for JSON/XML (i.e. '(custom) POST') too # Test Host header only if # --level >= 5 diff --git a/lib/core/settings.py b/lib/core/settings.py index f61af8168..e27142979 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.11.52" +VERSION = "1.10.11.53" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)