From a9b6a07641c317fedc260424d33e7f96321a7088 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Mon, 11 Nov 2019 14:03:43 +0100 Subject: [PATCH] Fixes #4006 --- lib/controller/checks.py | 8 ++++++-- lib/core/option.py | 4 ++++ lib/core/settings.py | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 8e915989f..288601855 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -786,8 +786,12 @@ def checkSqlInjection(place, parameter, value): infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert logger.info(infoMsg) - process = subprocess.Popen(conf.alert.encode(sys.getfilesystemencoding() or UNICODE_ENCODING), shell=True) - process.wait() + try: + process = subprocess.Popen(conf.alert.encode(sys.getfilesystemencoding() or UNICODE_ENCODING), shell=True) + process.wait() + except Exception as ex: + errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex)) + logger.error(errMsg) kb.alerted = True diff --git a/lib/core/option.py b/lib/core/option.py index f8abca785..329816977 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -2560,6 +2560,10 @@ def _basicOptionValidation(): errMsg = "option '--proxy' is incompatible with switch '--ignore-proxy'" raise SqlmapSyntaxException(errMsg) + if conf.alert and conf.alert.startswith('-'): + errMsg = "value for option '--alert' must be valid operating system command(s)" + raise SqlmapSyntaxException(errMsg) + if conf.timeSec < 1: errMsg = "value for option '--time-sec' must be a positive integer" raise SqlmapSyntaxException(errMsg) diff --git a/lib/core/settings.py b/lib/core/settings.py index 8ca09f7e7..a935254a2 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.3.11.28" +VERSION = "1.3.11.29" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)