CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-13 19:34:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix for SSTI --os-cmd reporting fabricated output on shell-less engines (e.g. Freemarker)

Browse source
This commit is contained in:
Miroslav Štampar 2026-11-12 14:46:02 +01:00
parent d1ceaf9365
commit b85cd4cc15
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -19,7 +19,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.11.38"
VERSION = "1.10.11.39"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

4
lib/techniques/ssti/inject.py
View file

@ -1019,7 +1019,9 @@ def _executeCommand(place, parameter, engine, cmd):
payload = payloadTemplate.replace("{CMD}", framedCmd)
page = getUnicode(_send(place, parameter, original + payload) or "")
out = _framedOutput(page, start, end)
if out is not None:
# Note: without a shell (e.g. Java's Runtime.exec) printf recycles its format over the rest of the (unexecuted) command
# line (e.g. ';id;printf%s%s'), "reproducing" both markers by itself - leftover format is the telltale
if out is not None and "%s%s" not in out:
conf.dumper.singleString("\nos-shell (%s) [%s]:\n%s" % (cmd, description, out))
return