CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing H2 file write

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-21 12:34:18 +02:00
parent 99ec51f86d
commit a7c63afdd8
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.166"
VERSION = "1.10.7.167"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

11
plugins/dbms/h2/filesystem.py
View file

@ -6,7 +6,7 @@ See the file 'LICENSE' for copying permission
"""
from lib.core.common import checkFile
from lib.core.convert import getText
from lib.core.convert import encodeHex
from lib.core.data import kb
from lib.core.data import logger
from lib.core.enums import CHARSET_TYPE
@ -34,14 +34,15 @@ class Filesystem(GenericFilesystem):
self.checkDbmsOs()
with open(localFile, "rb") as f:
content = getText(f.read())
content = f.read()
infoMsg = "writing the file content to '%s'" % remoteFile
logger.info(infoMsg)
# NOTE: FILE_WRITE() is the H2 builtin counterpart of FILE_READ(); being a plain scalar it needs no
# stacked queries (the write happens as a side effect over UNION/error/blind). The content is passed
# as a string literal (STRINGTOUTF8) so it survives sqlmap's CHAR()-encoding (unlike an X'..' literal)
inject.getValue("CAST(FILE_WRITE(STRINGTOUTF8('%s'),'%s') AS INT)" % (content.replace("'", "''"), remoteFile), expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
# stacked queries. Content is passed as a binary hex literal (X'..') so arbitrary/binary bytes survive
# byte-for-byte - the old STRINGTOUTF8() of a getText()-decoded string mangled any non-UTF-8 content,
# and H2 has no string->binary decoder (HEXTORAW/base64/UNHEX absent); cf. MySQL's 0x<hex> literal
inject.getValue("CAST(FILE_WRITE(X'%s','%s') AS INT)" % (encodeHex(content, binary=False), remoteFile), expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
return self.askCheckWrittenFile(localFile, remoteFile, forceCheck)