diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 3e3e31044..b5c9be321 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -659,6 +659,8 @@ def heuristicCheckSqlInjection(place, parameter): payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) casting = Request.queryPage(payload, place, raise404=False) + kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE + if casting: errMsg = "possible %s casting " % ("integer" if origValue.isdigit() else "type") errMsg += "detected (e.g. %s=(int)$_REQUEST('%s')) " % (parameter, parameter) @@ -677,8 +679,6 @@ def heuristicCheckSqlInjection(place, parameter): infoMsg += "not be injectable" logger.warn(infoMsg) - kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE - return kb.heuristicTest def checkDynParam(place, parameter, value):