diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 111a13468..6aa1e5aa7 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -633,17 +633,17 @@ def heuristicCheckSqlInjection(place, parameter): infoMsg = "heuristic test shows that %s " % place infoMsg += "parameter '%s' might " % parameter - kb.heuristicTest = result - if not result and kb.dynamicParameter: _ = conf.paramDict[place][parameter] - if _.isdigit(): + if _ and _.isdigit(): randInt = int(randomInt()) payload = "%s%s%s" % (prefix, "%s-%s" % (int(_) + randInt, randInt), suffix) payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) result = Request.queryPage(payload, place, raise404=False) + kb.heuristicTest = result + if result: infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION) logger.info(infoMsg)