From fcec8ef89ee96187840289e5c8561353f8995106 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Thu, 23 Jul 2026 12:56:24 +0200 Subject: [PATCH] Fixing CI/CD errors --- extra/vulnserver/vulnserver.py | 4 ++++ lib/core/settings.py | 2 +- lib/techniques/hql/inject.py | 17 +++++++++++++++-- 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py index e1a438864..e82f38506 100644 --- a/extra/vulnserver/vulnserver.py +++ b/extra/vulnserver/vulnserver.py @@ -266,6 +266,10 @@ def _hql_atom(atom): if match: return match.group(1) == match.group(2) + match = re.match(r"^(\d+)\s*=\s*(\d+)$", atom) # numeric literal 1=1 / 1=2 + if match: + return match.group(1) == match.group(2) + match = re.match(r"^\w+\s*=\s*'([^']*)'$", atom) # outer: name = 'X' if match: return HQL_RECORD["name"] == match.group(1) diff --git a/lib/core/settings.py b/lib/core/settings.py index 8cbbf896e..bc6c5821d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.178" +VERSION = "1.10.7.179" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/techniques/hql/inject.py b/lib/techniques/hql/inject.py index 7d2d0745e..f880e497a 100644 --- a/lib/techniques/hql/inject.py +++ b/lib/techniques/hql/inject.py @@ -348,6 +348,19 @@ def _shortEntity(entity): return re.split(r"[.$]", entity)[-1] if entity else entity +def _exists(truth, predicate): + """Existence probe helper: an unmapped entity/attribute makes the ORM query fail + to compile (error page), which for a yes/no existence question is a definitive + 'no'. Unlike value bisection - where a transient error must stay inconclusive so + it never freezes a wrong bit - an inconclusive/error existence probe reads as + false (matching the pre-recalibration oracle semantics these probes rely on).""" + + try: + return truth(predicate) + except InconclusiveError: + return False + + def _bruteEntities(truth): """Recover mapped entity names through the boolean oracle alone (no reflected diagnostic needed): a mapped name keeps the FROM clause valid, an unmapped one @@ -356,7 +369,7 @@ def _bruteEntities(truth): retVal = [] for entity in HQL_COMMON_ENTITIES: - if truth("EXISTS(SELECT 1 FROM %s _h)" % entity): + if _exists(truth, "EXISTS(SELECT 1 FROM %s _h)" % entity): retVal.append(entity) return retVal @@ -370,7 +383,7 @@ def _enumFields(truth, entity): if len(fields) >= HQL_MAX_FIELDS: break predicate = "EXISTS(SELECT _h.%s FROM %s _h)" % (field, entity) - if truth(predicate): + if _exists(truth, predicate): fields.append(field) logger.info("identified mapped attribute: '%s'" % field) return fields