From c0d4db3aba40c7f373b8895f334cd21e8569ebf3 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Sun, 13 Jan 2019 12:07:46 +0100 Subject: [PATCH] URI injection patch (on request by @bojanisc) --- lib/core/agent.py | 2 +- lib/core/settings.py | 2 +- txt/checksum.md5 | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index 19b6a07b7..b20e368e2 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -107,7 +107,7 @@ class Agent(object): else: origValue = filter(None, (re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z")))[0].group(0) origValue = origValue[origValue.rfind('/') + 1:] - for char in ('?', '=', ':', ','): + for char in ('?', '=', ':', ',', '&'): if char in origValue: origValue = origValue[origValue.rfind(char) + 1:] elif place == PLACE.CUSTOM_POST: diff --git a/lib/core/settings.py b/lib/core/settings.py index 58a11dc5d..315c58ad7 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME from lib.core.enums import OS # sqlmap version (...) -VERSION = "1.3.1.47" +VERSION = "1.3.1.48" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/txt/checksum.md5 b/txt/checksum.md5 index 54adfe612..7da8b4423 100644 --- a/txt/checksum.md5 +++ b/txt/checksum.md5 @@ -27,7 +27,7 @@ eaccf6204d8c44cee9daba955af0c85e lib/controller/checks.py 3c18f0b1d1b9fda682201a264f170b31 lib/controller/controller.py e97a9d34fef5761a8eab6432ce3c7c53 lib/controller/handler.py fb6be55d21a70765e35549af2484f762 lib/controller/__init__.py -6da66134fec9d81492e5b7c7241fdbd9 lib/core/agent.py +ed7874be0d2d3802f3d20184f2b280d5 lib/core/agent.py fdabbf8dda7277e5f4e3d0a6252cffb6 lib/core/bigarray.py 4706fb856c1662ef5afd747544d0d8cb lib/core/common.py de8d27ae6241163ff9e97aa9e7c51a18 lib/core/convert.py @@ -49,7 +49,7 @@ fe370021c6bc99daf44b2bfc0d1effb3 lib/core/patch.py 9a7d68d5fa01561500423791f15cc676 lib/core/replication.py 3179d34f371e0295dd4604568fb30bcd lib/core/revision.py d6269c55789f78cf707e09a0f5b45443 lib/core/session.py -5e0f2b028357ec0b63678438fca8c4d5 lib/core/settings.py +e6b4873ae0e82e43a62dcdfd670feb61 lib/core/settings.py a8a7501d1e6b21669b858a62e921d191 lib/core/shell.py 5dc606fdf0afefd4b305169c21ab2612 lib/core/subprocessng.py eec3080ba5baca44c6de4595f1c92a0d lib/core/target.py