Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b72cdfe

Browse files
stamparmstamparm
committed
fix for mssql regarding usage of schema names reported by [email protected]
1 parent 5a1aaec commit b72cdfe

2 files changed

Lines changed: 16 additions & 9 deletions

File tree

‎plugins/generic/enumeration.py‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -896,7 +896,10 @@ def getColumns(self, onlyColNames=False):
896896
raise sqlmapMissingMandatoryOptionException, errMsg
897897

898898
if "." in conf.tbl:
899-
conf.db, conf.tbl = conf.tbl.split(".")
899+
if not conf.db:
900+
conf.db, conf.tbl = conf.tbl.split(".")
901+
elif Backend.getIdentifiedDbms() == DBMS.MSSQL:
902+
conf.tbl = "dbo.%s" % conf.tbl
900903

901904
self.forceDbmsEnum()
902905

@@ -977,7 +980,7 @@ def getColumns(self, onlyColNames=False):
977980
query = rootQuery.inband.query % (conf.db, conf.db,
978981
conf.db, conf.db,
979982
conf.db, conf.db,
980-
conf.db, conf.tbl)
983+
conf.db, conf.tbl if '.' not in conf.tbl else conf.tbl.split('.')[1])
981984
query += condQuery.replace("[DB]", conf.db)
982985
elif Backend.getIdentifiedDbms() == DBMS.SQLITE:
983986
query = rootQuery.inband.query % conf.tbl
@@ -1016,7 +1019,8 @@ def getColumns(self, onlyColNames=False):
10161019
query += condQuery
10171020

10181021
elif Backend.getIdentifiedDbms() in DBMS.MSSQL:
1019-
query = rootQuery.blind.count % (conf.db, conf.db, conf.tbl)
1022+
query = rootQuery.blind.count % (conf.db, conf.db, \
1023+
conf.tbl if '.' not in conf.tbl else conf.tbl.split('.')[1])
10201024
query += condQuery.replace("[DB]", conf.db)
10211025

10221026
elif Backend.getIdentifiedDbms() == DBMS.FIREBIRD:
@@ -1055,7 +1059,7 @@ def getColumns(self, onlyColNames=False):
10551059
query = rootQuery.blind.query % (conf.db, conf.db,
10561060
conf.db, conf.db,
10571061
conf.db, conf.db,
1058-
conf.tbl)
1062+
conf.tbl if '.' not in conf.tbl else conf.tbl.split('.')[1])
10591063
query += condQuery.replace("[DB]", conf.db)
10601064
field = condition.replace("[DB]", conf.db)
10611065
elif Backend.getIdentifiedDbms() == DBMS.FIREBIRD:
@@ -1203,7 +1207,10 @@ def dumpTable(self):
12031207
return
12041208

12051209
if "." in conf.tbl:
1206-
conf.db, conf.tbl = conf.tbl.split(".")
1210+
if not conf.db:
1211+
conf.db, conf.tbl = conf.tbl.split(".")
1212+
elif Backend.getIdentifiedDbms() == DBMS.MSSQL:
1213+
conf.tbl = "dbo.%s" % conf.tbl
12071214

12081215
self.forceDbmsEnum()
12091216

‎xml/queries.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -183,17 +183,17 @@
183183
<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases)" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>
184184
</dbs>
185185
<tables>
186-
<inband query="SELECT name FROM %s..sysobjects WHERE xtype IN ('u','v')"/>
187-
<blind query="SELECT TOP 1 name FROM %s..sysobjects WHERE xtype IN ('u','v') AND name NOT IN (SELECT TOP %d name FROM %s..sysobjects WHERE xtype IN ('u','v'))" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE xtype IN ('u','v')"/>
186+
<inband query="SELECT sysusers.name+'.'+sysobjects.name FROM %s..sysobjects INNER JOIN sysusers ON sysobjects.uid = sysusers.uid WHERE xtype IN ('u', 'v')"/>
187+
<blind query="SELECT TOP 1 sysusers.name+'.'+sysobjects.name FROM %s..sysobjects INNER JOIN sysusers ON sysobjects.uid = sysusers.uid WHERE xtype IN ('u', 'v') AND sysusers.name+'.'+sysobjects.name NOT IN (SELECT TOP %d sysusers.name+'.'+sysobjects.name FROM %s..sysobjects INNER JOIN sysusers ON sysobjects.uid = sysusers.uid WHERE xtype IN ('u', 'v'))" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE xtype IN ('u','v')"/>
188188
</tables>
189189
<columns>
190190
<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" condition="[DB]..syscolumns.name"/>
191191
<blind query="SELECT %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>
192192
</columns>
193193
<dump_table>
194-
<inband query="SELECT %s FROM %s..%s"/>
194+
<inband query="SELECT %s FROM %s.%s"/>
195195
<!--<blind query="SELECT TOP 1 %s FROM %s..%s WHERE %s NOT IN (SELECT TOP %d %s FROM %s..%s)" count="SELECT LTRIM(STR(COUNT(*))) FROM %s..%s"/>-->
196-
<blind query="SELECT TOP 1 %s FROM (SELECT TOP 1 * FROM ( SELECT TOP %d * FROM %s..%s ORDER BY %s ASC ) AS t1 ORDER BY %s DESC) AS t2 ORDER BY %s ASC" count="SELECT LTRIM(STR(COUNT(*))) FROM %s..%s"/>
196+
<blind query="SELECT TOP 1 %s FROM (SELECT TOP 1 * FROM ( SELECT TOP %d * FROM %s.%s ORDER BY %s ASC ) AS t1 ORDER BY %s DESC) AS t2 ORDER BY %s ASC" count="SELECT LTRIM(STR(COUNT(*))) FROM %s.%s"/>
197197
</dump_table>
198198
<search_db>
199199
<inband query="SELECT name FROM master..sysdatabases WHERE " condition="name"/>

0 commit comments

Comments
 (0)