SQLMAP dump bug

[AmericanY]

SQLMAP version: {1.4.5.10#dev}

Issue: I'm dealing with website running Microsoft SQL Server where i can only dump the columns entry using -D dbname -T tblname -C colname --dump

But if i used --sql-query="SELECT colname FROM dbname.tblname" or run it using sql-shell

It's keep telling [WARNING] the SQL query provided does not return any output

I believe that's a bug because within the same target i were able to dump it before i update sqlmap recently .

Please let me know which information do i need to share to investigate the issue.

[stamparm]

For starter, you had a complete Bug report template which you skipped to fill

[AmericanY]

@stamparm sorry about that. here's it sir.

Describe the bug

I'm unable to dump using sql-query or sql-shell But I'm able to see the column names only.

On the other side, I'm able to dump using -D dbname -T tblname -C colname --dump

If i typed:

SELECT * FROM dbname.tblname

sqlmap were able to display the full column names and then will give the following output:

[WARNING] the SQL query provided does not return any output

To Reproduce

1. Run

sqlmap -u "http://target.com/xx.php?xx1=en&xx2=test" -p xx2 --random-agent --level=5 --risk=3 --dbms=MSSQL --technique=U --union-cols=4 --sql-shell

Expected behavior
expecting it to dump the target as usual.

Screenshots
If applicable, add screenshots to help explain your problem.

Running environment:

• sqlmap version [1.4.5.10#dev]
• Installation method [git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev]
• Operating system: [Ubuntu Server 20.04 LTS]
• Python version [3.8.2]

Target details:

• DBMS [Microsoft SQL Server]
• SQLi techniques found by sqlmap [Generic UNION query (NULL) - 4 columns (custom)]
• WAF/IPS [There's Not]

[stamparm]

i were able to dump it before i update sqlmap recently <- can you please download one of older releases from https://github.com/sqlmapproject/sqlmap/releases and prove your claims (e.g. https://github.com/sqlmapproject/sqlmap/releases/tag/1.4 from start of this year)? Preferably rerun everything with --flush-session so we could be sure that all data is re-done.

[AmericanY]

@stamparm I tested it and i can confirm that the issue is just about to add dbo before the table name.

So:

SELECT colname FROM dbname.dbo.tblname

Works fine.

The latest version doesn't use dbo prefix within sql-query and sql-shell it's only using it if I've used

-D dbname -T tblname -C colname --dump

[stamparm]

1. Just checked. It is not true that this same thing worked previously. Just checked the version 1.3. Same thing applies.
2. Not actually the "sqlmap" bug as you are directly providing the SQL query to be used
3. Nevertheless, I could "patch" it

[AmericanY]

@stamparm kindly be informed that the issue presented once again.

for such table name #__test

if i selected it using SELECT * FROM #__test where the table name enclosed within "``"

then i noticed a wrong request done using the following

"SELECT * FROM ``"