Skip to content

Single column enumeration (-C) broken for Firebird backend #4613

Description

@ptitdoc

Describe the bug
When using sqlmap against a firebird backend, the -C options does not work properly.

When counting the number of items in the column, the select request appends the database name FIREBIRD_MASTERDB to the column name, which does not exists in a firebird context.

The consequence is that sqlmap shows all rows as NULL.

To Reproduce

  1. Run sqlmap with the options -C MY_COLUMN_NAME on an sql injection with a firebird backend
  2. See all rows reported as NULL

Expected behavior
sqmap should have a positive count of rows and start enumerating all rows.

Running environment:

  • sqlmap version: 1.5.2
  • Installation method: pacman -S sqlmap
  • Operating system: Archlinux
  • Python version: 3.9.1

Target details:

  • DBMS: Firebird

Additional context
This problem can be avoided by retrieving the data using a select query.

It is also possible to write a tamper script to clear the invalid database name in all requests:

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.NORMAL

def tamper(payload, **kwargs):

    retVal = payload.replace("FIREBIRD_MASTERDB.","")
    return retVal

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions