Describe the bug
When using sqlmap against a firebird backend, the -C options does not work properly.
When counting the number of items in the column, the select request appends the database name FIREBIRD_MASTERDB to the column name, which does not exists in a firebird context.
The consequence is that sqlmap shows all rows as NULL.
To Reproduce
- Run sqlmap with the options -C MY_COLUMN_NAME on an sql injection with a firebird backend
- See all rows reported as NULL
Expected behavior
sqmap should have a positive count of rows and start enumerating all rows.
Running environment:
- sqlmap version: 1.5.2
- Installation method: pacman -S sqlmap
- Operating system: Archlinux
- Python version: 3.9.1
Target details:
Additional context
This problem can be avoided by retrieving the data using a select query.
It is also possible to write a tamper script to clear the invalid database name in all requests:
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.NORMAL
def tamper(payload, **kwargs):
retVal = payload.replace("FIREBIRD_MASTERDB.","")
return retVal
Describe the bug
When using sqlmap against a firebird backend, the -C options does not work properly.
When counting the number of items in the column, the select request appends the database name FIREBIRD_MASTERDB to the column name, which does not exists in a firebird context.
The consequence is that sqlmap shows all rows as NULL.
To Reproduce
Expected behavior
sqmap should have a positive count of rows and start enumerating all rows.
Running environment:
Target details:
Additional context
This problem can be avoided by retrieving the data using a select query.
It is also possible to write a tamper script to clear the invalid database name in all requests: