PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

Patch for an Issue reported privately via email

Browse Source
This commit is contained in:
Miroslav Stampar
2017-07-05 12:15:14 +02:00
parent ba369b73d3
commit a4ebd5418f
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/request/inject.py
View File

@@ -345,6 +345,10 @@ def getValue(expression, blind=True, union=True, error=True, time=True, fromUser
kb.safeCharEncode = safeCharEncode
kb.resumeValues = resumeValue
# Note: following keywords are expected to be in uppercase
for keyword in ("SELECT", "FROM", "WHERE"):
expression = re.sub("(?i)(\A|\(|\)|\s)%s(\Z|\(|\)|\s)" % keyword, r"\g<1>%s\g<2>" % keyword, expression)
if suppressOutput is not None:
pushValue(getCurrentThreadData().disableStdOut)
getCurrentThreadData().disableStdOut = suppressOutput
@@ -356,7 +360,7 @@ def getValue(expression, blind=True, union=True, error=True, time=True, fromUser
if expected == EXPECTED.BOOL:
forgeCaseExpression = booleanExpression = expression
if expression.upper().startswith("SELECT "):
if expression.startswith("SELECT "):
booleanExpression = "(%s)=%s" % (booleanExpression, "'1'" if "'1'" in booleanExpression else "1")
else:
forgeCaseExpression = agent.forgeCaseStatement(expression)