CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor patches

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-11 15:18:42 +02:00
parent 97c8b45ccc
commit ab59a4b72a
8 changed files with 62 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

13
plugins/dbms/mssqlserver/connector.py
View file

@ -54,11 +54,20 @@ class Connector(GenericConnector):
logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " "))
return None
def execute(self, query):
def execute(self, query, commit=True):
retVal = False
try:
self.cursor.execute(getText(query))
# Commit non-SELECT (DML/DDL) here: direct() routes those to execute() alone, so without this a
# '--sql-query'/'--sql-shell' write was silently rolled back on connection close. select() passes
# commit=False and commits only AFTER fetchall(), because on pymssql commit() discards the open
# result cursor (which otherwise emptied every SELECT result).
if commit:
try:
self.connector.commit()
except pymssql.OperationalError:
pass
retVal = True
except (pymssql.OperationalError, pymssql.ProgrammingError) as ex:
logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " "))
@ -70,7 +79,7 @@ class Connector(GenericConnector):
def select(self, query):
retVal = None
if self.execute(query):
if self.execute(query, commit=False):
retVal = self.fetchall()
try:

3
plugins/dbms/mysql/connector.py
View file

@ -12,7 +12,6 @@ except:
import logging
import struct
import sys
from lib.core.common import getSafeExString
from lib.core.data import conf
@ -34,7 +33,7 @@ class Connector(GenericConnector):
self.initConnection()
try:
self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password.encode(sys.stdin.encoding), db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True)
self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password, db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True)
except (pymysql.OperationalError, pymysql.InternalError, pymysql.ProgrammingError, struct.error) as ex:
raise SqlmapConnectionException(getSafeExString(ex))

5
plugins/dbms/postgresql/connector.py
View file

@ -55,7 +55,10 @@ class Connector(GenericConnector):
try:
self.cursor.execute(query)
retVal = True
except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex:
# Note: also catch DataError/IntegrityError (e.g. division-by-zero, bad cast, unique violation from a
# user '--sql-query') so the commit() below still runs and clears the aborted transaction; otherwise
# PostgreSQL poisons every later query with 'InFailedSqlTransaction' and silently returns None
except (psycopg2.OperationalError, psycopg2.ProgrammingError, psycopg2.DataError, psycopg2.IntegrityError) as ex:
logger.warning(("(remote) '%s'" % getSafeExString(ex)).strip())
except psycopg2.InternalError as ex:
raise SqlmapConnectionException(getSafeExString(ex))

3
plugins/dbms/postgresql/takeover.py
View file

@ -17,6 +17,7 @@ from lib.core.common import isNoneValue
from lib.core.common import isStackingAvailable
from lib.core.common import randomStr
from lib.core.compat import LooseVersion
from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.data import paths
@ -100,7 +101,7 @@ class Takeover(GenericTakeover):
def copyExecCmd(self, cmd):
output = None
if isStackingAvailable():
if isStackingAvailable() or conf.direct:
# Reference: https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
self._forgedCmd = "DROP TABLE IF EXISTS %s;" % self.cmdTblName
self._forgedCmd += "CREATE TABLE %s(%s text);" % (self.cmdTblName, self.tblField)

13
plugins/dbms/sybase/connector.py
View file

@ -54,11 +54,20 @@ class Connector(GenericConnector):
logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " "))
return None
def execute(self, query):
def execute(self, query, commit=True):
retVal = False
try:
self.cursor.execute(getText(query))
# Commit non-SELECT (DML/DDL) here: direct() routes those to execute() alone, so without this a
# '--sql-query'/'--sql-shell' write was silently rolled back on connection close. select() passes
# commit=False and commits only AFTER fetchall(), because on pymssql commit() discards the open
# result cursor (which otherwise emptied every SELECT result).
if commit:
try:
self.connector.commit()
except pymssql.OperationalError:
pass
retVal = True
except (pymssql.OperationalError, pymssql.ProgrammingError) as ex:
logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " "))
@ -70,7 +79,7 @@ class Connector(GenericConnector):
def select(self, query):
retVal = None
if self.execute(query):
if self.execute(query, commit=False):
retVal = self.fetchall()
try: