sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 19:13:48 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix for URI based injections

Browse Source
This commit is contained in:
Miroslav Stampar 2011-01-22 16:23:33 +00:00
parent 7bf05bf2cb
commit 30cd877c4a
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/core/agent.py
View File

@ -75,6 +75,10 @@ class Agent:
paramDict = conf.paramDict[place] paramDict = conf.paramDict[place]
origValue = paramDict[parameter] origValue = paramDict[parameter]
if place == PLACE.URI:
origValue = origValue.split('*')[0]
origValue = origValue[origValue.rfind('/') + 1:]
if value is None: if value is None:
if where == 1: if where == 1:
value = origValue value = origValue
@ -101,7 +105,7 @@ class Agent:
retValue = ET.tostring(root) retValue = ET.tostring(root)
elif place in (PLACE.UA, PLACE.URI): elif place in (PLACE.UA, PLACE.URI):
retValue = paramString.replace("*", self.addPayloadDelimiters(newValue)) retValue = paramString.replace("%s*" % origValue, self.addPayloadDelimiters(newValue))
else: else:
retValue = paramString.replace("%s=%s" % (parameter, origValue), retValue = paramString.replace("%s=%s" % (parameter, origValue),
"%s=%s" % (parameter, self.addPayloadDelimiters(newValue))) "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)))