From 73d0c67a8019b349462625ddc2263d83e6aed759 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Wed, 28 Oct 2020 12:57:25 +0100 Subject: [PATCH] Implements #4407 --- lib/core/settings.py | 2 +- lib/techniques/union/use.py | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 09ae92e9d..7c21b1d89 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.4.10.22" +VERSION = "1.4.10.23" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/techniques/union/use.py b/lib/techniques/union/use.py index 3539cb806..20856c3e1 100644 --- a/lib/techniques/union/use.py +++ b/lib/techniques/union/use.py @@ -248,11 +248,15 @@ def unionUse(expression, unpack=True, dump=False): # Set kb.partRun in case the engine is called from the API kb.partRun = getPartRun(alias=False) if conf.api else None - if Backend.isDbms(DBMS.MYSQL) and expressionFields: + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE) and expressionFields: match = re.search(r"SELECT\s*(.+?)\bFROM", expression, re.I) - if match: + if match and not (Backend.isDbms(DBMS.ORACLE) and FROM_DUMMY_TABLE[DBMS.ORACLE] in expression): kb.jsonAggMode = True - _ = expression.replace(expressionFields, "CONCAT('%s',JSON_ARRAYAGG(CONCAT_WS('%s',%s)),'%s')" % (kb.chars.start, kb.chars.delimiter, expressionFields, kb.chars.stop), 1) + if Backend.isDbms(DBMS.MYSQL): + _ = expression.replace(expressionFields, "CONCAT('%s',JSON_ARRAYAGG(CONCAT_WS('%s',%s)),'%s')" % (kb.chars.start, kb.chars.delimiter, expressionFields, kb.chars.stop), 1) + else: + _ = expression.replace(expressionFields, "'%s'||JSON_ARRAYAGG(%s)||'%s'" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join(expressionFieldsList), kb.chars.stop), 1) + _ = re.sub(r"(?i)\s*ORDER BY ROWNUM", "", _) output = _oneShotUnionUse(_, False) value = parseUnionPage(output) kb.jsonAggMode = False