-
-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Closed
Labels
Description
Describe the bug
I was using SQLmap to test some parameters and it identified a PostgreSQL injection (this was ultimately incorrect but that doesn't matter). It asked if I wanted to skip test payloads for other DBMSes. I entered "n".
However, on subsequent lines (I run SQLmap with -v3) I saw the following kind of debug messages:
[DEBUG] skipping test 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' because its declared DBMS is different than identified
It seems that SQLmap isn't processing my answer to the question properly, because from that point on it only tried PostgreSQL payloads.
To Reproduce
- Run SQLmap against a known vulnerable request.
- When asked if you want to skip test payloads for other DBMSes enter "n".
- Note that SQLmap seems to still skip test payloads.
Expected behavior
SQLmap should ignore the identified DBMS and still send other DBMS payloads.
Running environment:
- sqlmap version: 1.6.7.2#dev
- Installation method: git
- Operating system: Kali 2021.1
- Python version: 3.9.1
Target details:
- DBMS: Oracle
- SQLi techniques found by sqlmap: PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)' injectable (with --code=302) FALSE POSITIVE