diff --git a/lib/controller/action.py b/lib/controller/action.py index 6ae232373..40ea3f26e 100644 --- a/lib/controller/action.py +++ b/lib/controller/action.py @@ -181,7 +181,10 @@ def action(): raise if conf.sqlQuery: - conf.dumper.sqlQuery(conf.sqlQuery, conf.dbmsHandler.sqlQuery(conf.sqlQuery)) + for query in conf.sqlQuery.strip(';').split(';'): + query = query.strip() + if query: + conf.dumper.sqlQuery(query, conf.dbmsHandler.sqlQuery(query)) if conf.sqlShell: conf.dbmsHandler.sqlShell() diff --git a/lib/core/settings.py b/lib/core/settings.py index 27e05ec7c..6c8c5eb85 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.3.11.102" +VERSION = "1.3.11.103" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/core/testing.py b/lib/core/testing.py index 7ef9e72de..65e2b037c 100644 --- a/lib/core/testing.py +++ b/lib/core/testing.py @@ -80,7 +80,7 @@ def vulnTest(): ("-u '&echo=foobar*' --flush-session", ("might be vulnerable to cross-site scripting",)), ("-u '&query=*' --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3")), ("-d --flush-session --dump -T users --binary-fields=name --where \"id=3\"", ("7775", "179ad45c6ce2cb97cf1029e212046e81 (testpass)",)), - ("-d --flush-session --banner --schema --sql-query=\"SELECT 987654321\"", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "[*] 987654321",)), + ("-d --flush-session --banner --schema --sql-query=\"UPDATE users SET name='foobar' WHERE id=5; SELECT * FROM users; SELECT 987654321\"", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "5, foobar, nameisnull", "[*] 987654321",)), ) retVal = True diff --git a/plugins/generic/custom.py b/plugins/generic/custom.py index 7fb200d30..41860b569 100644 --- a/plugins/generic/custom.py +++ b/plugins/generic/custom.py @@ -61,16 +61,13 @@ class Custom(object): return None else: if sqlType: - debugMsg = "executing %s query: '%s'" % (sqlType if sqlType is not None else "SQL", query) + infoMsg = "executing %s statement: '%s'" % (sqlType if sqlType is not None else "SQL", query) else: - debugMsg = "executing unknown SQL type query: '%s'" % query - logger.debug(debugMsg) + infoMsg = "executing unknown SQL command: '%s'" % query + logger.info(infoMsg) inject.goStacked(query) - debugMsg = "done" - logger.debug(debugMsg) - output = NULL except SqlmapNoneDataException as ex: