Skip to content

1.4.3 breaks some injections with quotes #4277

@lyghtnox

Description

@lyghtnox

Describe the bug
Version 1.4.3 surrounds the database name with quotes in some requests (count in time based postgresql injection).
This breaks some injections where the quotes aren't allowed.

To Reproduce

  1. Try to dump data for this challenge on root-me with version>=1.4.3
  2. See error

[WARNING] unable to retrieve the number of column(s) '...' entries for table '...' in database '...'

Expected behavior
Count of the number of columns

Running environment:

  • sqlmap version >=1.4.3
  • Installation method: git
  • Operating system: Parrot OS

Target details:

  • DBMS: PostgreSQL
  • SQLi techniques found by sqlmap: PostgreSQL > 8.1 stacked queries (comment)
  • Relevant console output: [WARNING] unable to retrieve the number of column(s) '...' entries for table '...' in database '...'

Additional context
Request for version <= 1.4.2:
1;SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(id AS CHARACTER(10000)),(CHR(32))) FROM public.users ORDER BY id OFFSET 1 LIMIT 1)::text FROM 1 FOR 1))>64) THEN (SELECT 3979 FROM PG_SLEEP(5)) ELSE 3979 END)--

Request for version >= 1.4.3:
1;SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(COUNT(*) AS VARCHAR(10000))::text,(CHR(32))) FROM "public".users)::text FROM 1 FOR 1))>51) THEN (SELECT 3658 FROM PG_SLEEP(5)) ELSE 3658 END)--

Newer versions add quotes around db name, which breaks the injection in some cases

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions