Fixes #2052

lib/core/settings.py

@@ -19,7 +19,7 @@ from lib.core.enums import OS
 from lib.core.revision import getRevisionNumber
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.0.7.37"
+VERSION = "1.0.7.38"
 REVISION = getRevisionNumber()
 STABLE = VERSION.count('.') <= 2
 VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")

lib/techniques/union/use.py

@@ -111,8 +111,13 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
                     for column in kb.dumpColumns:
                         base64 = True
                         for child in root:
+                            value = child.attrib.get(column, "").strip()
+                            if value and not re.match(r"\A[a-zA-Z0-9+/]+={0,2}\Z", value):
+                                base64 = False
+                                break
+
                             try:
-                                child.attrib.get(column, "").decode("base64")
+                                value.decode("base64")
                             except binascii.Error:
                                 base64 = False
                                 break