From ab0df2a85cfa570b134e16a05724b61aa522feb4 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Thu, 31 Dec 2020 12:09:15 +0100 Subject: [PATCH] Fixes #4503 --- lib/controller/checks.py | 3 ++- lib/core/settings.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 5aa1de157..2119233ef 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -1137,7 +1137,8 @@ def heuristicCheckSqlInjection(place, parameter): paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place - if value.lower() in (page or "").lower(): + # Reference: https://bugs.python.org/issue18183 + if value.upper() in (page or "").upper(): infoMsg = "heuristic (XSS) test shows that %sparameter '%s' might be vulnerable to cross-site scripting (XSS) attacks" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) diff --git a/lib/core/settings.py b/lib/core/settings.py index 160a52fa1..dcba54e37 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.4.12.42" +VERSION = "1.4.12.43" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)