CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Hiding --alert behind SQLMAP_UNSAFE_ALERT

Browse source
This commit is contained in:
Your Name 2026-04-15 19:27:35 +02:00
parent 608412907a
commit 93cbbc2378
3 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/core/option.py
View file

@ -2671,6 +2671,13 @@ def _basicOptionValidation():
errMsg = "switch '--dump' is incompatible with switch '--search'"
raise SqlmapSyntaxException(errMsg)
if conf.alert and os.environ.get("SQLMAP_UNSAFE_ALERT") != '1':
errMsg = "for security reasons, to prevent execution of potentially malicious "
errMsg += "OS commands via configuration files or copy-paste attacks, "
errMsg += "the '--alert' option requires the environment variable "
errMsg += "'SQLMAP_UNSAFE_ALERT=1' to be explicitly set"
raise SqlmapSystemException(errMsg)
if conf.chunked and not any((conf.data, conf.requestFile, conf.forms)):
errMsg = "switch '--chunked' requires usage of (POST) options/switches '--data', '-r' or '--forms'"
raise SqlmapSyntaxException(errMsg)

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.4.2"
VERSION = "1.10.4.3"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)