CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing DB2 boolean-based blind retrieval of non-ASCII chars

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-27 12:52:08 +02:00
parent 1d263f22c3
commit d3cfad6a8d
4 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
data/xml/queries.xml
View file

@ -626,7 +626,7 @@
<dbms value="IBM DB2">
<!-- VARCHAR(32672) (DB2 max), not CHAR(254) which silently truncated values >254 chars; RTRIM kept to strip CHAR-column blank padding (DB2 <v9, which lacked the VARCHAR cast, is long unsupported) -->
<cast query="RTRIM(CAST(%s AS VARCHAR(32672)))"/>
<length query="LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))))"/>
<length query="CHARACTER_LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))),CODEUNITS32)"/>
<isnull query="COALESCE(%s,' ')"/>
<delimiter query="||"/>
<limit query="ROW_NUMBER() OVER () AS CAP %s) AS qq WHERE CAP"/>
@ -638,11 +638,11 @@
<count query="COUNT(%s)"/>
<comment query="--"/>
<!-- TODO -->
<substring query="SUBSTR((%s),%d,%d)"/>
<substring query="SUBSTRING((%s),%d,%d,CODEUNITS32)"/>
<concatenate query="%s||%s"/>
<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END) FROM SYSIBM.SYSDUMMY1"/>
<hex query="HEX(%s)"/>
<inference query="SUBSTR((%s),%d,1)>'%c'"/>
<inference query="SUBSTRING((%s),%d,1,CODEUNITS32)>'%c'"/>
<!-- NOTE: We have to use the complicated UDB OLAP functions in query2 because sqlmap injects isnull query inside MAX function, else we would use: SELECT MAX(versionnumber) FROM sysibm.sysversions -->
<banner query="SELECT service_level FROM TABLE(sysproc.env_get_inst_info())" query2="SELECT versionnumber FROM (SELECT ROW_NUMBER() OVER (ORDER BY versionnumber DESC) AS CAP,versionnumber FROM sysibm.sysversions) AS qq WHERE CAP=1"/>
<current_user query="SELECT user FROM SYSIBM.SYSDUMMY1"/>

2
lib/core/common.py
View file

@ -4003,7 +4003,7 @@ def decodeIntToUnicode(value):
# Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478
# supplementary codepoints (>0xFFFF, _SC collations) aren't 2-byte UTF-16; decode direct
retVal = _unichr(value) if value > 0xFFFF else getUnicode(raw, "UTF-16-BE")
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
retVal = _unichr(value)
else:
retVal = getUnicode(raw, conf.encoding)

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.204"
VERSION = "1.10.7.205"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

12
plugins/dbms/db2/syntax.py
View file

@ -5,7 +5,8 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
See the file 'LICENSE' for copying permission
"""
from lib.core.convert import getOrds
from lib.core.convert import getBytes
from lib.core.settings import UNICODE_ENCODING
from plugins.generic.syntax import Syntax as GenericSyntax
class Syntax(GenericSyntax):
@ -17,6 +18,13 @@ class Syntax(GenericSyntax):
"""
def escaper(value):
return "||".join("CHR(%d)" % _ for _ in getOrds(value))
# CHR() is byte-based on DB2, so a non-ASCII codepoint needs its UTF-8 bytes to form a single char
result = []
for char in value:
if ord(char) < 128:
result.append("CHR(%d)" % ord(char))
else:
result.extend("CHR(%d)" % _ for _ in bytearray(getBytes(char, UNICODE_ENCODING, errors="replace", unsafe=False)))
return "||".join(result)
return Syntax._escape(expression, quote, escaper)