From d3cfad6a8d228ac5332ef4d022464568f169c57d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= <miroslav.stampar@gmail.com>
Date: Mon, 27 Jul 2026 12:52:08 +0200
Subject: [PATCH] Fixing DB2 boolean-based blind retrieval of non-ASCII chars

---
 data/xml/queries.xml       |  6 +++---
 lib/core/common.py         |  2 +-
 lib/core/settings.py       |  2 +-
 plugins/dbms/db2/syntax.py | 12 ++++++++++--
 4 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/data/xml/queries.xml b/data/xml/queries.xml
index a1c8aaf59..c48c0379c 100644
--- a/data/xml/queries.xml
+++ b/data/xml/queries.xml
@@ -626,7 +626,7 @@
     <dbms value="IBM DB2">
         <!-- VARCHAR(32672) (DB2 max), not CHAR(254) which silently truncated values >254 chars; RTRIM kept to strip CHAR-column blank padding (DB2 <v9, which lacked the VARCHAR cast, is long unsupported) -->
         <cast query="RTRIM(CAST(%s AS VARCHAR(32672)))"/>
-        <length query="LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))))"/>
+        <length query="CHARACTER_LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))),CODEUNITS32)"/>
         <isnull query="COALESCE(%s,' ')"/>
         <delimiter query="||"/>
         <limit query="ROW_NUMBER() OVER () AS CAP %s) AS qq WHERE CAP"/>
@@ -638,11 +638,11 @@
         <count query="COUNT(%s)"/>
         <comment query="--"/>
         <!-- TODO -->
-        <substring query="SUBSTR((%s),%d,%d)"/>
+        <substring query="SUBSTRING((%s),%d,%d,CODEUNITS32)"/>
         <concatenate query="%s||%s"/>
         <case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END) FROM SYSIBM.SYSDUMMY1"/>
         <hex query="HEX(%s)"/>
-        <inference query="SUBSTR((%s),%d,1)>'%c'"/>
+        <inference query="SUBSTRING((%s),%d,1,CODEUNITS32)>'%c'"/>
         <!-- NOTE: We have to use the complicated UDB OLAP functions in query2 because sqlmap injects isnull query inside MAX function, else we would use: SELECT MAX(versionnumber) FROM sysibm.sysversions -->
         <banner query="SELECT service_level FROM TABLE(sysproc.env_get_inst_info())" query2="SELECT versionnumber FROM (SELECT ROW_NUMBER() OVER (ORDER BY versionnumber DESC) AS CAP,versionnumber FROM sysibm.sysversions) AS qq WHERE CAP=1"/>
         <current_user query="SELECT user FROM SYSIBM.SYSDUMMY1"/>
diff --git a/lib/core/common.py b/lib/core/common.py
index e1d72a1d9..a8b5705f1 100644
--- a/lib/core/common.py
+++ b/lib/core/common.py
@@ -4003,7 +4003,7 @@ def decodeIntToUnicode(value):
                     # Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478
                     # supplementary codepoints (>0xFFFF, _SC collations) aren't 2-byte UTF-16; decode direct
                     retVal = _unichr(value) if value > 0xFFFF else getUnicode(raw, "UTF-16-BE")
-                elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE):     # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
+                elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2):     # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
                     retVal = _unichr(value)
                 else:
                     retVal = getUnicode(raw, conf.encoding)
diff --git a/lib/core/settings.py b/lib/core/settings.py
index 0170ea301..3449e9b53 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.204"
+VERSION = "1.10.7.205"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/plugins/dbms/db2/syntax.py b/plugins/dbms/db2/syntax.py
index 7ba5c8b9f..2dd6088a6 100644
--- a/plugins/dbms/db2/syntax.py
+++ b/plugins/dbms/db2/syntax.py
@@ -5,7 +5,8 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.convert import getOrds
+from lib.core.convert import getBytes
+from lib.core.settings import UNICODE_ENCODING
 from plugins.generic.syntax import Syntax as GenericSyntax
 
 class Syntax(GenericSyntax):
@@ -17,6 +18,13 @@ class Syntax(GenericSyntax):
         """
 
         def escaper(value):
-            return "||".join("CHR(%d)" % _ for _ in getOrds(value))
+            # CHR() is byte-based on DB2, so a non-ASCII codepoint needs its UTF-8 bytes to form a single char
+            result = []
+            for char in value:
+                if ord(char) < 128:
+                    result.append("CHR(%d)" % ord(char))
+                else:
+                    result.extend("CHR(%d)" % _ for _ in bytearray(getBytes(char, UNICODE_ENCODING, errors="replace", unsafe=False)))
+            return "||".join(result)
 
         return Syntax._escape(expression, quote, escaper)