CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-13 11:25:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix for user's LIMIT being ignored by UNION JSON aggregation (e.g. --sql-query)

Browse source
This commit is contained in:
Miroslav Štampar 2026-11-12 14:53:41 +01:00
parent 057e614500
commit 4df83fe737
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -19,7 +19,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.11.43"
VERSION = "1.10.11.44"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

5
lib/techniques/union/use.py
View file

@ -353,8 +353,11 @@ def unionUse(expression, unpack=True, dump=False):
debugMsg += "it does not play well with UNION query SQL injection"
singleTimeDebugMessage(debugMsg)
# Note: (outer) LIMIT/OFFSET/FETCH would apply to the single aggregated row (i.e. being ignored), while Microsoft SQL Server's FOR JSON wraps the whole statement
limited = not Backend.isDbms(DBMS.MSSQL) and any(zeroDepthSearch(expression.upper(), _) for _ in (" LIMIT ", " OFFSET ", " FETCH "))
# Note: Oracle, PostgreSQL, Microsoft SQL Server and SQLite aggregate the raw (not hex-converted) fields, while parseUnionPage() decodes them all in case of '--hex'
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL, DBMS.SQLITE, DBMS.H2, DBMS.HSQLDB, DBMS.FIREBIRD) and expressionFields and not any((conf.binaryFields, conf.limitStart, conf.limitStop, conf.disableJson)) and not (conf.hexConvert and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL, DBMS.SQLITE)):
if not limited and Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL, DBMS.SQLITE, DBMS.H2, DBMS.HSQLDB, DBMS.FIREBIRD) and expressionFields and not any((conf.binaryFields, conf.limitStart, conf.limitStop, conf.disableJson)) and not (conf.hexConvert and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL, DBMS.SQLITE)):
match = re.search(r"SELECT\s*(.+?)\bFROM", expression, re.I)
if match and not (Backend.isDbms(DBMS.ORACLE) and FROM_DUMMY_TABLE[DBMS.ORACLE] in expression) and not re.search(r"\b(MIN|MAX|COUNT|EXISTS)\(", expression):
kb.jsonAggMode = True