From 32a4f6c32f19c0abb855d669e72451fc654f54fb Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Sun, 25 Aug 2019 13:20:06 +0200 Subject: [PATCH] Initial patch for #3894 (not final) --- lib/core/common.py | 4 ++-- lib/core/settings.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/core/common.py b/lib/core/common.py index 6ef4b193d..6f6ffb1bc 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -624,7 +624,7 @@ def paramToDict(place, parameters=None): try: oldValue = value value = decodeBase64(value, binary=False) - parameters = re.sub(r"\b%s\b" % re.escape(oldValue), value, parameters) + parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters) except: errMsg = "parameter '%s' does not contain " % parameter errMsg += "valid Base64 encoded value ('%s')" % value @@ -701,7 +701,7 @@ def paramToDict(place, parameters=None): message += "has boundaries. Do you want to inject inside? ('%s') [y/N] " % getUnicode(_) if readInput(message, default='N', boolean=True): - testableParameters[parameter] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), (r"\g<1>%s" % re.sub(regex, r"\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter])).replace("\\", r"\\"), parameters) + testableParameters[parameter] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), (r"\g<1>%s" % re.sub(regex, r"\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter].replace("\\", r"\\"))), parameters) break if conf.testParameter: diff --git a/lib/core/settings.py b/lib/core/settings.py index 0cad2432f..6175a432d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.3.8.22" +VERSION = "1.3.8.23" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)