CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-27 04:05:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor patch
Some checks are pending
/ build (macos-latest, 3.8) (push) Waiting to run
Details
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
Details
/ build (windows-latest, 3.14) (push) Waiting to run
Details

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-08 02:09:35 +02:00
parent f65dc92b1e
commit 89ddc5a592
3 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.37" VERSION = "1.10.7.38"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

2
plugins/dbms/oracle/syntax.py
View file

@ -16,6 +16,8 @@ class Syntax(GenericSyntax):
True True
>>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||NCHR(235)||CHR(102)||CHR(103)||CHR(104) FROM foobar" >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||NCHR(235)||CHR(102)||CHR(103)||CHR(104) FROM foobar"
True True
>>> Syntax.escape("SELECT 'a''b' FROM DUAL") == "SELECT CHR(97)||CHR(39)||CHR(98) FROM DUAL"
True
""" """
def escaper(value): def escaper(value):

19
plugins/generic/syntax.py
View file

@ -26,18 +26,21 @@ class Syntax(object):
retVal = expression retVal = expression
if quote: if quote:
for item in re.findall(r"'[^']*'+", expression): # Match a full SQL string literal, honouring the '' (doubled single quote) escape - e.g.
original = item[1:-1] # 'a''b' is ONE literal whose value is a'b, not 'a'' followed by a dangling b'. The old
if original: # r"'[^']*'+" split on the inner '' and left the tail bare, corrupting the encoded payload.
for item in re.findall(r"'(?:[^']|'')*'", expression):
value = item[1:-1].replace("''", "'") # inner content with '' collapsed to the real quote
if value:
if Backend.isDbms(DBMS.SQLITE) and "X%s" % item in expression: if Backend.isDbms(DBMS.SQLITE) and "X%s" % item in expression:
continue continue
if re.search(r"\[(SLEEPTIME|RAND)", original) is None: # e.g. '[SLEEPTIME]' marker if re.search(r"\[(SLEEPTIME|RAND)", value) is None: # e.g. '[SLEEPTIME]' marker
replacement = escaper(original) if not conf.noEscape else original replacement = escaper(value) if not conf.noEscape else value
if replacement != original: if replacement != value:
retVal = retVal.replace(item, replacement) retVal = retVal.replace(item, replacement)
elif len(original) != len(getBytes(original)) and "n'%s'" % original not in retVal and Backend.getDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.ORACLE, DBMS.MSSQL): elif len(value) != len(getBytes(value)) and "n%s" % item not in retVal and Backend.getDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.ORACLE, DBMS.MSSQL):
retVal = retVal.replace("'%s'" % original, "n'%s'" % original) retVal = retVal.replace(item, "n%s" % item)
else: else:
retVal = escaper(expression) retVal = escaper(expression)