diff --git a/lib/core/settings.py b/lib/core/settings.py index 5e1c73478..ddd02152e 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.216" +VERSION = "1.10.7.217" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/utils/keysetdump.py b/lib/utils/keysetdump.py index eaed7b2f9..387b59794 100644 --- a/lib/utils/keysetdump.py +++ b/lib/utils/keysetdump.py @@ -246,8 +246,15 @@ def _dumpComposite(tbl, colList, count, cursorCols, tableRef, entries, lengths): if prev is None: condition = "1=1" else: - # ANSI row-value (tuple) comparison advances the composite cursor lexicographically - condition = "(%s)>(%s)" % (orderExpr, ','.join(_lit(_) for _ in prev)) + # Portable lexicographic seek predicate. ANSI row-value comparison ((a,b)>(x,y)) is not + # supported on MSSQL/Oracle - there it errored, stopping the walk after the first row - + # so expand it to (a>x) OR (a=x AND b>y) OR ... which uses only scalar comparisons. + ors = [] + for i in xrange(len(fields)): + terms = ["%s=%s" % (fields[j], _lit(prev[j])) for j in xrange(i)] + terms.append("%s>%s" % (fields[i], _lit(prev[i]))) + ors.append("(%s)" % " AND ".join(terms)) + condition = "(%s)" % " OR ".join(ors) tup = [] for field in fields: