sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-03 05:04:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

bug fix and proper warning message

Browse Source
This commit is contained in:
Miroslav Stampar 2011-01-15 16:59:53 +00:00
parent e105e1ea32
commit 0f565c941e
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/controller/checks.py
View File

@ -20,6 +20,7 @@ from lib.core.common import getComparePageRatio
from lib.core.common import getCompiledRegex from lib.core.common import getCompiledRegex
from lib.core.common import getErrorParsedDBMSes from lib.core.common import getErrorParsedDBMSes
from lib.core.common import getErrorParsedDBMSesFormatted from lib.core.common import getErrorParsedDBMSesFormatted
from lib.core.common import getIdentifiedDBMS
from lib.core.common import getInjectionTests from lib.core.common import getInjectionTests
from lib.core.common import getUnicode from lib.core.common import getUnicode
from lib.core.common import popValue from lib.core.common import popValue
@ -379,6 +380,17 @@ def checkSqlInjection(place, parameter, value):
# NOTE: vector is set to a tuple with 6 elements, # NOTE: vector is set to a tuple with 6 elements,
# used afterwards by Agent.forgeInbandQuery() # used afterwards by Agent.forgeInbandQuery()
# method to forge the UNION query payload # method to forge the UNION query payload
# Set current fingeprinted DBMS according to the
# current test settings for proper unescaping
kb.misc.fpDbms = dbms
if not getIdentifiedDBMS():
warnMsg = "using unescaped version of the test "
warnMsg += "because of zero knowledge of the "
warnMsg += "back-end DBMS"
logger.warn(warnMsg)
configUnion(test.request.char, test.request.columns) configUnion(test.request.char, test.request.columns)
dbmsToUnescape = dbms if dbms is not None else injection.dbms dbmsToUnescape = dbms if dbms is not None else injection.dbms
reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix, dbmsToUnescape) reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix, dbmsToUnescape)
@ -393,6 +405,8 @@ def checkSqlInjection(place, parameter, value):
# in unionTest()'s vector (1 or 2) # in unionTest()'s vector (1 or 2)
where = vector[6] where = vector[6]
kb.misc.fpDbms = None
# If the injection test was successful feed the injection # If the injection test was successful feed the injection
# object with the test's details # object with the test's details
if injectable is True: if injectable is True: