From f21a6ab88db917c12dfc709f82e10e85bfce9923 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Tue, 28 Jul 2026 21:27:49 +0200 Subject: [PATCH] Fixing blind enumeration (MS Access listing only first table; MySQL --privileges user labeling) --- lib/core/settings.py | 2 +- plugins/generic/databases.py | 4 ++-- plugins/generic/users.py | 7 +++++-- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 1eae49f1d..c8865064d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.229" +VERSION = "1.10.7.230" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/plugins/generic/databases.py b/plugins/generic/databases.py index f01d4095b..becad0332 100644 --- a/plugins/generic/databases.py +++ b/plugins/generic/databases.py @@ -418,9 +418,9 @@ class Databases(object): else: for index in indexRange: if Backend.isDbms(DBMS.SYBASE): - query = _query % (db, (kb.data.cachedTables[-1] if kb.data.cachedTables else " ")) + query = _query % (db, (tables[-1] if tables else " ")) elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB): - query = _query % (kb.data.cachedTables[-1] if kb.data.cachedTables else " ") + query = _query % (tables[-1] if tables else " ") elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): query = _query % index elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.INFORMIX, DBMS.FRONTBASE, DBMS.VIRTUOSO): diff --git a/plugins/generic/users.py b/plugins/generic/users.py index e22c96d5a..7bd070510 100644 --- a/plugins/generic/users.py +++ b/plugins/generic/users.py @@ -648,13 +648,16 @@ class Users(object): break if privileges: - kb.data.cachedUsersPrivileges[user] = list(privileges) + # Note: 'user' may be a LIKE-wrapped form (e.g. '%root%') built for the MySQL + # query above; key/record under the real name so the output isn't mislabelled + # (and the retrievedUsers de-dup check, which compares the unwrapped name, works) + kb.data.cachedUsersPrivileges[outuser] = list(privileges) else: warnMsg = "unable to retrieve the privileges " warnMsg += "for user '%s'" % outuser logger.warning(warnMsg) - retrievedUsers.add(user) + retrievedUsers.add(outuser) if not kb.data.cachedUsersPrivileges: errMsg = "unable to retrieve the privileges "