From b85cd4cc15161fd81750689ce3bc093072f675d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Thu, 12 Nov 2026 14:46:02 +0100 Subject: [PATCH] Fix for SSTI --os-cmd reporting fabricated output on shell-less engines (e.g. Freemarker) --- lib/core/settings.py | 2 +- lib/techniques/ssti/inject.py | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index e34663ae4..6f46a774c 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.11.38" +VERSION = "1.10.11.39" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/techniques/ssti/inject.py b/lib/techniques/ssti/inject.py index 98b3fb8d4..aed7e2fc1 100644 --- a/lib/techniques/ssti/inject.py +++ b/lib/techniques/ssti/inject.py @@ -1019,7 +1019,9 @@ def _executeCommand(place, parameter, engine, cmd): payload = payloadTemplate.replace("{CMD}", framedCmd) page = getUnicode(_send(place, parameter, original + payload) or "") out = _framedOutput(page, start, end) - if out is not None: + # Note: without a shell (e.g. Java's Runtime.exec) printf recycles its format over the rest of the (unexecuted) command + # line (e.g. ';id;printf%s%s'), "reproducing" both markers by itself - leftover format is the telltale + if out is not None and "%s%s" not in out: conf.dumper.singleString("\nos-shell (%s) [%s]:\n%s" % (cmd, description, out)) return