Skip to content

"Skip Test Payloads Specific for other DBMSes" appears to not work correctly. #5154

@Tib3rius

Description

@Tib3rius

Describe the bug
I was using SQLmap to test some parameters and it identified a PostgreSQL injection (this was ultimately incorrect but that doesn't matter). It asked if I wanted to skip test payloads for other DBMSes. I entered "n".

However, on subsequent lines (I run SQLmap with -v3) I saw the following kind of debug messages:

[DEBUG] skipping test 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' because its declared DBMS is different than identified

It seems that SQLmap isn't processing my answer to the question properly, because from that point on it only tried PostgreSQL payloads.

To Reproduce

  1. Run SQLmap against a known vulnerable request.
  2. When asked if you want to skip test payloads for other DBMSes enter "n".
  3. Note that SQLmap seems to still skip test payloads.

Expected behavior
SQLmap should ignore the identified DBMS and still send other DBMS payloads.

Running environment:

  • sqlmap version: 1.6.7.2#dev
  • Installation method: git
  • Operating system: Kali 2021.1
  • Python version: 3.9.1

Target details:

  • DBMS: Oracle
  • SQLi techniques found by sqlmap: PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)' injectable (with --code=302) FALSE POSITIVE

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions