mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-04-02 08:14:17 +03:00
Minor enhancement to prefix payload in ORDER BY and GROUP BY clauses
This commit is contained in:
parent
bb40ab9fb0
commit
b824826a89
|
@ -257,7 +257,7 @@ def checkSqlInjection(place, parameter, value):
|
|||
if where == 1:
|
||||
origValue = value
|
||||
elif where == 2:
|
||||
origValue = "-%s" % value
|
||||
origValue = "-%s" % randomInt()
|
||||
elif where == 3:
|
||||
origValue = ""
|
||||
|
||||
|
|
|
@ -83,7 +83,7 @@ class Agent:
|
|||
if where == 1:
|
||||
value = origValue
|
||||
elif where == 2:
|
||||
value = "-%s" % origValue
|
||||
value = "-%s" % randomInt()
|
||||
elif where == 3:
|
||||
value = ""
|
||||
else:
|
||||
|
@ -155,10 +155,12 @@ class Agent:
|
|||
# payload, do not put a space after the prefix
|
||||
if kb.technique == 4:
|
||||
query = kb.injection.prefix
|
||||
elif kb.technique and kb.technique in kb.injection.data:
|
||||
elif (kb.technique and kb.technique in kb.injection.data) or \
|
||||
(kb.injection.clause == [2, 3] or kb.injection.clause == [ 2 ]):
|
||||
where = kb.injection.data[kb.technique].where
|
||||
|
||||
if where == 3:
|
||||
if where == 3 or (kb.injection.clause == [2, 3] or \
|
||||
kb.injection.clause == [ 2 ]):
|
||||
query = kb.injection.prefix
|
||||
|
||||
if query is None:
|
||||
|
|
Loading…
Reference in New Issue
Block a user