CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing blind enumeration (MS Access listing only first table; MySQL --privileges user labeling)

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-28 21:27:49 +02:00
parent 1b09b028ba
commit f21a6ab88d
3 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.229" VERSION = "1.10.7.230"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

4
plugins/generic/databases.py
View file

@ -418,9 +418,9 @@ class Databases(object):
else: else:
for index in indexRange: for index in indexRange:
if Backend.isDbms(DBMS.SYBASE): if Backend.isDbms(DBMS.SYBASE):
query = _query % (db, (kb.data.cachedTables[-1] if kb.data.cachedTables else " ")) query = _query % (db, (tables[-1] if tables else " "))
elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB): elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB):
query = _query % (kb.data.cachedTables[-1] if kb.data.cachedTables else " ") query = _query % (tables[-1] if tables else " ")
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD):
query = _query % index query = _query % index
elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.INFORMIX, DBMS.FRONTBASE, DBMS.VIRTUOSO): elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.INFORMIX, DBMS.FRONTBASE, DBMS.VIRTUOSO):

7
plugins/generic/users.py
View file

@ -648,13 +648,16 @@ class Users(object):
break break
if privileges: if privileges:
kb.data.cachedUsersPrivileges[user] = list(privileges) # Note: 'user' may be a LIKE-wrapped form (e.g. '%root%') built for the MySQL
# query above; key/record under the real name so the output isn't mislabelled
# (and the retrievedUsers de-dup check, which compares the unwrapped name, works)
kb.data.cachedUsersPrivileges[outuser] = list(privileges)
else: else:
warnMsg = "unable to retrieve the privileges " warnMsg = "unable to retrieve the privileges "
warnMsg += "for user '%s'" % outuser warnMsg += "for user '%s'" % outuser
logger.warning(warnMsg) logger.warning(warnMsg)
retrievedUsers.add(user) retrievedUsers.add(outuser)
if not kb.data.cachedUsersPrivileges: if not kb.data.cachedUsersPrivileges:
errMsg = "unable to retrieve the privileges " errMsg = "unable to retrieve the privileges "