CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-14 11:56:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for -p matching inside other parameter names (e.g. id in x-id)

Browse source
This commit is contained in:
Miroslav Štampar 2026-11-12 11:50:32 +01:00
parent 54c5a6582b
commit d55d163352
2 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/core/agent.py
View file

@ -278,14 +278,17 @@ class Agent(object):
retVal = string[:match.start()] + repl + string[match.end():] retVal = string[:match.start()] + repl + string[match.end():]
return retVal return retVal
# Note: parameter name has to start right after a delimiter (e.g. '-p id' must not match inside 'x-id=1')
boundary = r"(\A|(?<=[%s\s]))" % re.escape("%s%s%s" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER, conf.paramDel or ""))
if origValue: if origValue:
regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "") regex = r"%s%s=%s%s" % (boundary, re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "")
retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString) retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
else: else:
retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString) retVal = _(r"%s%s=%s(\Z|%s|%s|\s)" % (boundary, re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
if retVal == paramString and urlencode(parameter) != parameter: if retVal == paramString and urlencode(parameter) != parameter:
retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString) retVal = _(r"%s%s=%s" % (boundary, re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString)
if retVal: if retVal:
retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\') retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\')

2
lib/core/settings.py
View file

@ -19,7 +19,7 @@ from lib.core.enums import OS
from thirdparty import six from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.11.14" VERSION = "1.10.11.15"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)