From 077d58c5e9b3aea174b2597527f32d4aae93a796 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Thu, 30 Mar 2023 15:34:46 +0200 Subject: [PATCH] Fixes #5378 --- lib/core/settings.py | 2 +- plugins/dbms/hsqldb/filesystem.py | 13 +++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index e63816f29..482cf2182 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from thirdparty import six from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.7.3.4" +VERSION = "1.7.3.5" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/plugins/dbms/hsqldb/filesystem.py b/plugins/dbms/hsqldb/filesystem.py index b27607190..881074640 100644 --- a/plugins/dbms/hsqldb/filesystem.py +++ b/plugins/dbms/hsqldb/filesystem.py @@ -21,13 +21,13 @@ class Filesystem(GenericFilesystem): @stackedmethod def stackedWriteFile(self, localFile, remoteFile, fileType=None, forceCheck=False): - funcName = randomStr() + func_name = randomStr() max_bytes = 1024 * 1024 - debugMsg = "creating JLP procedure '%s'" % funcName + debugMsg = "creating JLP procedure '%s'" % func_name logger.debug(debugMsg) - addFuncQuery = "CREATE PROCEDURE %s (IN paramString VARCHAR, IN paramArrayOfByte VARBINARY(%s)) " % (funcName, max_bytes) + addFuncQuery = "CREATE PROCEDURE %s (IN paramString VARCHAR, IN paramArrayOfByte VARBINARY(%s)) " % (func_name, max_bytes) addFuncQuery += "LANGUAGE JAVA DETERMINISTIC NO SQL " addFuncQuery += "EXTERNAL NAME 'CLASSPATH:com.sun.org.apache.xml.internal.security.utils.JavaUtils.writeBytesToFilename'" inject.goStacked(addFuncQuery) @@ -47,11 +47,12 @@ class Filesystem(GenericFilesystem): logger.debug(debugMsg) # Reference: http://hsqldb.org/doc/guide/sqlroutines-chapt.html#src_jrt_procedures - invokeQuery = "CALL %s('%s', CAST('%s' AS VARBINARY(%s)))" % (funcName, remoteFile, fcEncodedStr, max_bytes) + invokeQuery = "CALL %s('%s', CAST('%s' AS VARBINARY(%s)))" % (func_name, remoteFile, fcEncodedStr, max_bytes) inject.goStacked(invokeQuery) - logger.debug("cleaning up" % funcName) - delQuery = "DELETE PROCEDURE %s" % funcName + logger.debug("cleaning up the database management system") + + delQuery = "DELETE PROCEDURE %s" % func_name inject.goStacked(delQuery) message = "the local file '%s' has been written on the back-end DBMS" % localFile