-
-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Description
Describe the bug
Version 1.4.3 surrounds the database name with quotes in some requests (count in time based postgresql injection).
This breaks some injections where the quotes aren't allowed.
To Reproduce
- Try to dump data for this challenge on root-me with version>=1.4.3
- See error
[WARNING] unable to retrieve the number of column(s) '...' entries for table '...' in database '...'
Expected behavior
Count of the number of columns
Running environment:
- sqlmap version >=1.4.3
- Installation method: git
- Operating system: Parrot OS
Target details:
- DBMS: PostgreSQL
- SQLi techniques found by sqlmap: PostgreSQL > 8.1 stacked queries (comment)
- Relevant console output: [WARNING] unable to retrieve the number of column(s) '...' entries for table '...' in database '...'
Additional context
Request for version <= 1.4.2:
1;SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(id AS CHARACTER(10000)),(CHR(32))) FROM public.users ORDER BY id OFFSET 1 LIMIT 1)::text FROM 1 FOR 1))>64) THEN (SELECT 3979 FROM PG_SLEEP(5)) ELSE 3979 END)--
Request for version >= 1.4.3:
1;SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(COUNT(*) AS VARCHAR(10000))::text,(CHR(32))) FROM "public".users)::text FROM 1 FOR 1))>51) THEN (SELECT 3658 FROM PG_SLEEP(5)) ELSE 3658 END)--
Newer versions add quotes around db name, which breaks the injection in some cases