diff --git a/lib/core/settings.py b/lib/core/settings.py
index e8d6d729d..f0f669a3c 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.139"
+VERSION = "1.10.7.140"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/lib/request/connect.py b/lib/request/connect.py
index ca94c570a..9e333efef 100644
--- a/lib/request/connect.py
+++ b/lib/request/connect.py
@@ -1272,13 +1272,16 @@ class Connect(object):
                 if urlencode(parameter) in paramString:
                     parameter = urlencode(parameter)
 
-                match = re.search(r"%s=[^&]*" % re.escape(parameter), paramString, re.I)
+                # Note: anchor to a real parameter boundary (start or right after '&'/a quote) so that
+                # adjusting e.g. 'token' does not match inside a longer name like 'csrf_token'/'user_token'
+                # and rewrite the wrong parameter (which broke anti-CSRF token injection)
+                match = re.search(r"(?i)(?:\A|(?<=&))%s=[^&]*" % re.escape(parameter), paramString)
                 if match:
-                    retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), ("%s=%s" % (parameter, newValue)).replace('\\', r'\\'), paramString)
+                    retVal = "%s%s=%s%s" % (paramString[:match.start()], parameter, newValue, paramString[match.end():])
                 else:
-                    match = re.search(r"(%s[\"']\s*:\s*[\"'])([^\"']*)" % re.escape(parameter), paramString, re.I)
+                    match = re.search(r"(?i)[\"']%s[\"']\s*:\s*[\"'](?P<value>[^\"']*)" % re.escape(parameter), paramString)
                     if match:
-                        retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), "%s%s" % (match.group(1), newValue), paramString)
+                        retVal = "%s%s%s" % (paramString[:match.start("value")], newValue, paramString[match.end("value"):])
 
                 return retVal